Extracted

• • Target

    JaffaCakes118_fb53e8329f479cdaacbe0ed5b092557a

  • Size

    168KB

  • MD5

    fb53e8329f479cdaacbe0ed5b092557a

  • SHA1

    aa520e659dd7af03a6fd6db2fee5db405ce9db98

  • SHA256

    ab561032327d25263d4e395d95659b682825d23e7df71bc979ac1ab8c022d7e3

  • SHA512

    0080712fe87dc5d7c296871cbfb18e758576830b12b8ef26cef0419d1cf114f4ec8a11383d69bce748c68637ede4fc6c466cd445457538560ae91ca06671d2ae

  • SSDEEP

    3072:Zx8tQMBl123mpqmBR/dvRRP8FLPf7GU9yXCRRlVwl9OmGEov:Zx8tPtR/LRP8FOpSRU

  Score

  10^/10

  njrat@@@@@@@@@@evasionpersistenceprivilege_escalationtrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2