Extracted

• • Target

    4360-114-0x0000000000F20000-0x0000000000F2C000-memory.dmp

  • Size

    48KB

  • MD5

    78111bae788bb581193c7378ddbf1934

  • SHA1

    728ea5bcc3a15b06e6e70ccb073cc978af444928

  • SHA256

    259ae04e113aaf7fd4fb26b3226f145c55444191e5f42f2883e59cde7398f8f2

  • SHA512

    f1f617cf3f81dcb59e835b0d5721e82572506c7a09758dffac0aee732b66a78e1c08d376375b5e95ad1a27ce8f847122d0aa74aa9c7b0ae04551c2460972988c

  • SSDEEP

    384:TqbjqhfPjAPYQMWSN4hxMEcBXugc2mMTAKZqP+xcV+ocGJN8/S3MqkvzUhX:+nqdqJSwr44/EqioSKBm4

  Score

  10^/10

  njrathackedevasionpersistencetrojan

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2