Extracted

• • Target

    JaffaCakes118_c9ea2c601f092e8af013d1eee3d15f3b

  • Size

    300KB

  • MD5

    c9ea2c601f092e8af013d1eee3d15f3b

  • SHA1

    16a0f37d44f602365ac18cab3cc216caa26f6a9d

  • SHA256

    40d209a52f28e901ef7c088a74fa7a4f4822d8c15460cfaa6fa73a4d4bb074ba

  • SHA512

    26ccbad8b7f82868f9a2ec034ce13424672bd6bc9c82843c8ce2253eef83ff449d0502def57a70ddd54d86d3bb879c91296f7198890f4c5c5482db565fb2b9ef

  • SSDEEP

    6144:EH+B6jXSEggT3L3PiO4ubwdjaKf7vfgDSMpv+u:EH+4jXagT3L3PiO4ubc/Tg7pv+u

  Score

  10^/10

  njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Disables Task Manager via registry modification

    evasion

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2