Extracted

• • Target

    JaffaCakes118_99b2f7822d52908284c83b114dc19ede

  • Size

    33KB

  • MD5

    99b2f7822d52908284c83b114dc19ede

  • SHA1

    9670074d06ceab739d9bd88b19dab68ac69ae637

  • SHA256

    29f4a7219a671bac2337402c9c5fd4cf1789ac818c321754b8824b486ffb717d

  • SHA512

    4fd010f336ffaacae1ea615ca62e3e285d3150981330f8b4ae3617478c3c886386d6544bdcced98851fd94231d1da8b40c584090246a9cc533ebcc2e641550c6

  • SSDEEP

    768:VvTUC66ha3MI3IOTTZs0y3MbKRSJebgCkjZtNM7U:tUC6v3G02M2gJYVkjpSU

  Score

  10^/10

  njratwindowsevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2