Overview

overview

10

Static

static

7ca1684c5b...82.exe

windows7_x64

10

7ca1684c5b...82.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ca1684c5b58b0ee2dcecc5b89e14170dde029855223dc79f1035da1a1345882

  • Size

    323KB

  • Sample

    210228-st23w6y8v6

  • MD5

    3065acf0e5b06d1bbdccd15bc48aa2eb

  • SHA1

    305b1629af0ad56bc8bf6584530f624a0868cc54

  • SHA256

    7ca1684c5b58b0ee2dcecc5b89e14170dde029855223dc79f1035da1a1345882

  • SHA512

    108ea1085afb046a8f0515ddc55bc3a3b4b604db75540761d94cd045b57dc8f461819e39f9a81ea3b1128b670d985029b1c8e49dd17fc69add839b89cfee219b

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      7ca1684c5b58b0ee2dcecc5b89e14170dde029855223dc79f1035da1a1345882

    • Size

      323KB

    • MD5

      3065acf0e5b06d1bbdccd15bc48aa2eb

    • SHA1

      305b1629af0ad56bc8bf6584530f624a0868cc54

    • SHA256

      7ca1684c5b58b0ee2dcecc5b89e14170dde029855223dc79f1035da1a1345882

    • SHA512

      108ea1085afb046a8f0515ddc55bc3a3b4b604db75540761d94cd045b57dc8f461819e39f9a81ea3b1128b670d985029b1c8e49dd17fc69add839b89cfee219b

    Score
    10/10
    njratevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks