Extracted

• • Target

    JaffaCakes118_65b9d6e4d666e561164559c668fe1eb0

  • Size

    1.2MB

  • MD5

    65b9d6e4d666e561164559c668fe1eb0

  • SHA1

    cd250e21ff05dc7453e1046316355c5fbeeced67

  • SHA256

    0f33d4f78934cae61e579ccc3b376f822267bfb4d2bfdf51740695800f88d804

  • SHA512

    7d0071fe3b7e2e2e91e11537339e1344a96853625cd0753df0af0b4e9e69c4afce8db20773a2867a1fa68c4ece0ba8ba920761b80086350b5e116efa2a2a617e

  • SSDEEP

    12288:PlcpiSYeriSVOaGTb17D+KHZnAJXtVW9RolEkcJXtVW9RolEk:PWpiSYeriuRG/xXaBCRBkcBCRBk

  Score

  10^/10

  njratembroideryevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2