Extracted

• • Target

    JaffaCakes118_777676310c24701745eafe775dfba946

  • Size

    24KB

  • MD5

    777676310c24701745eafe775dfba946

  • SHA1

    d7f8d08ddec2d0bb383e18fcc7644f2a851ac5a4

  • SHA256

    f30ea4f9504e4541a9fc609e7bb5283b8573adc002beac7c93b3d58d40896e2c

  • SHA512

    ee127c8764b33d21064433b0cd306e6c7f1e0d8e6b27b780387a8c4ed8687744e4b21f12706d563d55652cb56bea1737e5f7e1d4ead2019516f2de8c665a910b

  • SSDEEP

    384:oz/fEn+pvhlY15Mkatlxrgzr6G6ukCZCKp6SpaZAlt4bMc46x1:8/MnoYYniz76pCZCKkgZtML

  Score

  10^/10

  njrat‎cstrikeevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2