Extracted

• • Target

    JaffaCakes118_6987bc8d2458260efeea977790f30795

  • Size

    404KB

  • MD5

    6987bc8d2458260efeea977790f30795

  • SHA1

    b79826c1038605a767ee206e64bcc1821469a964

  • SHA256

    c7f90f1e0b0472e8e18f7e2da07fc9d00f404f2a51c31b66f19e9460a28c2d3b

  • SHA512

    0ad83c8836c7babbb321067add3a626d490faae48875a88699282b86d8f57ced3821fea825671fc02bb70ba4330e24a0cc1a91291db62923e7e9f016781f78d5

  • SSDEEP

    1536:Wc8HjOIQ++G/XPApdzB/VZ7+X0mw6bzP1PhoHitOZ6ExlgFom4G1G1O:Wc8HqIJPPKZB/VZ7+6i7citOZRlgFM

  Score

  10^/10

  njrathackedevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2