Extracted

• • Target

    JaffaCakes118_6a53de3968d2efc9beaefb836ae28d40

  • Size

    91KB

  • MD5

    6a53de3968d2efc9beaefb836ae28d40

  • SHA1

    e3acb62065db279b8c2feb3e0a24cc5aa254a653

  • SHA256

    932384d432e6077f1d2ada9c2271b68405286db32b1b14f16eef7c0f81244693

  • SHA512

    e2b6902b5affa2e50f1080c6d1cddca03136ffef3e9aa624491acd82b573312f9938755e87594054467aa6c5e182d486fea92abe640035e0262bcff37d3e5b2e

  • SSDEEP

    1536:9D1dJuyVzR0anIspQxldKVcwo9EsUDljjZujrjG+8+i3ezERGqes:9D1fuEV0aIspqb247U5UrPOGY

  Score

  10^/10

  njrathackedevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2