Extracted

• • Target

    JaffaCakes118_597c96810b1bfd18f7bbb2479a69fa20

  • Size

    942KB

  • MD5

    597c96810b1bfd18f7bbb2479a69fa20

  • SHA1

    04e755e11b1c8b6d447d3cd11928f66ae8b10f14

  • SHA256

    ff32ad858c823f2c6f318d5f306708a94dbb02a02193e69f8f5ba663ae8f8b7c

  • SHA512

    15bb08d21511630986754b6d8e9fb17e70e49bbcdb7557d1ca90b250f6e129804d3846d74d00b744d8fef03477701d6c659ae8e6057d11daad0e5db6c0c6628c

  • SSDEEP

    24576:Y/MY178kXE6/g0d882rs1geQx+/G8PF0Bi0m:YykXE6o0dDdQxIBFx0

  Score

  10^/10

  njrathackedevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2