Extracted

• • Target

    JaffaCakes118_5b7bb54c0837e6e8623ea67a021ae120

  • Size

    424KB

  • MD5

    5b7bb54c0837e6e8623ea67a021ae120

  • SHA1

    63ecd5b3acdd259329b0392eb8c702340c00f349

  • SHA256

    5a57b32a2e8709e68ee1de3feed7a0c3b79ee12da60fca5dab1594dec6a980ab

  • SHA512

    26464aa451addb04a88792cec3c4cf3f66c1f79bcd5818fb8e5a7889d91a5cced1f30ce750b2e093af0ca04dd756bc656454ebfdce48358a6586f85542be1d47

  • SSDEEP

    12288:vFJs3XraGmcmd/26o9juQ+pDQZP4dEin3EsYYbTu:vjs3XFxxpJ+pDKDin0VoTu

  Score

  10^/10

  njrathackeddiscoverytrojanupx

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Loads dropped DLL

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2