Extracted

• • Target

    JaffaCakes118_6a8c965281056303b644b31fc4aa6080

  • Size

    69KB

  • MD5

    6a8c965281056303b644b31fc4aa6080

  • SHA1

    9c2d82178da83916f18a074b34ca23da574daacb

  • SHA256

    d5cf78c53b8357164077ee44e8c0b237c2b75efd06961e9549fbea110a2de053

  • SHA512

    cab33f86a9efc3edd6402a117077655a72ac04515aa62132919a1046ddae57e1b9f279dc9fb668258d583285a088420f96c10ba0362255f1655731c12b8e6b4a

  • SSDEEP

    1536:GKKk6iEItiagPtHcEFv968/LBHV39QPWSxE0gNTfy4chu:MiEIti7tRv96iHSWkub

  Score

  10^/10

  njratmohamedevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2