Extracted

• • Target

    JaffaCakes118_601dfb7a98e57ececf07d2ada03536a0

  • Size

    233KB

  • MD5

    601dfb7a98e57ececf07d2ada03536a0

  • SHA1

    19dbc350938e846b5605c824d06c27b5b46ab4c1

  • SHA256

    5b2d7dab768bc2118c28c73e32cf7e1a4dd6129016abe2df6f0876d090ef56d4

  • SHA512

    66838b20e6de2ccb1f5255cc44d3deee30f193c71a5d3281bc05ff0dcea148fd2dd2b6461d9e4aa10af10e034ad8ff4e1e6235068b11f3dc0c734651800ea14a

  • SSDEEP

    3072:/DUAdD0ytjEI45F4i8tWTn90TL/mIPHlzi/9LavTfQmUskSQiKswVzL8FqvsJO:/D3Vy8twuf/mCHiLacLsyiKlgFqv

  Score

  10^/10

  discoverypersistencenjrathackedtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2