Extracted

• • Target

    JaffaCakes118_f7f61e2818f060f7bb67313e6add744b

  • Size

    6.0MB

  • MD5

    f7f61e2818f060f7bb67313e6add744b

  • SHA1

    178378f732bad62fabb2b184f688e8a6651a9d9e

  • SHA256

    a8aa4dd903c87f0912c6d4b65d26d7c1d75b1e02bda69b68ad1a57028ec9a0fa

  • SHA512

    3b77f2dc7606a525943ebf1d9447438d248d1a591bf94e43e166c4ae376e45a81c651a27a8628036d6158e31d52816b8227e44c34bab1e1c0e26e880aed2c570

  • SSDEEP

    98304:KxO6OvlIuBy4q7/bYy8yo+x2hbsOYah0ZWXy9YF3W3qywcrUKqXCvYJod1H2O:jvlJro/sRW2mOz9X0Y5arb9oxO

  Score

  10^/10

  njrathackedbootkitdiscoveryevasionpersistenceprivilege_escalationspywarestealertrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Downloads MZ/PE file

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks for any installed AV software in registry

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  behavioral1behavioral2