Extracted

• • Target

    1936-62-0x0000000000180000-0x00000000001C0000-memory.dmp

  • Size

    256KB

  • MD5

    448c9859b4e7e9c79e6ea34402f1aa69

  • SHA1

    f4044d5925f5dd4ba15cd9be1de1e408069410d2

  • SHA256

    5b88f3a2527be5fe528962f7a84102e8415987d0f9648be382897da8511b8ba3

  • SHA512

    d29cd9be1b63d848890829abe9742e2041dcea4c68d886e14c072c696a004673bdd72a83f8423c7ea4d59ff313bf0d9a042d278a8892be030b3176bb6d90675b

  • SSDEEP

    6144:mp3luhhPpL4hKXkEAk+p8pggenVd4hE1slKBYu:mdAL1u1a+qggenVOS1sl

  Score

  10^/10

  njratactivationevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2