Extracted

• • Target

    JaffaCakes118_a133801876213843bef755c27297d57c

  • Size

    164KB

  • MD5

    a133801876213843bef755c27297d57c

  • SHA1

    1f8f96742de98d063f9cd1aa29b339721dd37740

  • SHA256

    cd7d41450ffc7079b2161a20d02c5682e1a5eddf75b6fa1f31193f8067d20750

  • SHA512

    7af36a996d8c600edc5116b90447669ab53be64eb9217f3cda074e423d7b9ce6cf000b2cc3e89eb71f8053ae32906ec3fba2243bc9e8ea759489e434ff9fa341

  • SSDEEP

    3072:ZXaxkun1YV7MG6uRMwC5kMqQLXmEl5n9e+ktQ:VMKEkCLWQ9e+y

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2