Extracted

• • Target

    JaffaCakes118_ad0f6231d44f6d0e08379256a3f765c0

  • Size

    432KB

  • MD5

    ad0f6231d44f6d0e08379256a3f765c0

  • SHA1

    765c2ba3990b9c2a603a0012dfac8e34e39eda38

  • SHA256

    a665eae243d8d987de7378c95a9e7894d95b7ca6632e7455dcb9431870e67016

  • SHA512

    8bcf9c48c9137b897194cd757ff80153462ce2ad2f2d468ab70ba4479808f3a8bd99006d50a0802289de43092b7079286a86091674d0173325b50ad089309eb0

  • SSDEEP

    96:fsDYb94x6pIEYaXcwhx5zWLYxT9FS7Z0epAIb+zNt:UEb94x8pYapz1WLOxU7Z0dcY

  Score

  10^/10

  njrat2021evasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2