Extracted

• • Target

    2032-57-0x0000000001FE0000-0x0000000001FEC000-memory.dmp

  • Size

    48KB

  • MD5

    97dad9679b96b658bda97553b5625e8b

  • SHA1

    a2a908e661f57637cc7bed1773e0bd6dc91434ec

  • SHA256

    baa11c43a766dad1e9d258915a24828a478c5ef4256eded5f36e62439a1da5da

  • SHA512

    b44d69d61d997c7d9445f77e456cfed00a7dfbdcc10dd36814c1a0f076f66371b2f1fa138e022809cbc00b82af6b55d023ca685b35e1af9743505415da1a4962

  • SSDEEP

    384:b/slUlEvOEJ8xWwYJOMiOBZEdj1567gtwi5HhbQmRvR6JZlbw8hqIusZzZBH:bgeEvwIlLMRpcnua

  Score

  10^/10

  njratmalekaevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Executes dropped EXE

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2