Extracted

• • Target

    1728-14-0x0000000000950000-0x0000000000CC4000-memory.dmp

  • Size

    3.5MB

  • MD5

    f5e4136a654e56756591aee4431688e2

  • SHA1

    df26c2793bf0c2536f006cf5dbfd0331d4627478

  • SHA256

    93dabc5dcba6c87e164ae21f80c4d8896554777ebcf29644f28b0caef665c1cf

  • SHA512

    f9da803ac1015077182b97d1f9c74d2eb5e9dd0a1a509996cbab04e6774bd23c7e712e95381982e122b74e47e2bc5637f5ac1a7b66beafc0cd2f705d3928325c

  • SSDEEP

    49152:d/hfFXzMGDKZQMFcT6Iz5TxyhmdJIHMb4NnlgiTJUvb5i0x3T:dpFXzMGTUHI9xyfsbslgaJybB

  Score

  10^/10

  njrat2evasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops autorun.inf file

    Malware can abuse Windows Autorun to spread further via attached volumes.

  behavioral1behavioral2