Extracted

• • Target

    2788-29-0x00000000000F0000-0x0000000000466000-memory.dmp

  • Size

    3.5MB

  • MD5

    f41f059f4245ebc2caaa103103a4689a

  • SHA1

    c0b40d6520b58ce3e484d0f7c9ded7237c6fa059

  • SHA256

    2de37d5ef0c4b16a733af9802c00982fddb034f719b09c90140a7d65c7c97389

  • SHA512

    d0bd25c6558dec7ad6fc5ca4ed382fad82766db1551f654553c95b61fe57b228117bb818baf191256a49ed8e07b86247877ddaba86047091034e09b7c9ae0473

  • SSDEEP

    49152:/WwUXMaVn3pT4I/5xCiZ+fdSoR9tUwjenBaB94Pw:/7UX13+I7CYCeBaB9A

  Score

  10^/10

  njrathackeddiscoverypersistencetrojan

  • Njrat family

    njrat

  • njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2