Overview

overview

10

Static

static

a142637ef3...0b.exe

windows7_x64

10

a142637ef3...0b.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a142637ef315b12c7a4fbd775d20aa0b.exe

  • Size

    158KB

  • Sample

    211222-anx89segd9

  • MD5

    a142637ef315b12c7a4fbd775d20aa0b

  • SHA1

    501987446d082e356c412827736b5b1a2ed04b47

  • SHA256

    c9d747511a0384a1269928fb6486411d045616865ba88062e46d8307e01c780b

  • SHA512

    2b0175f57c996fd6d2313db124154a2b63491ae2da57ca0794e3875b2e40b450381dfaad0ac538e0ec1bd05d9881159f3c01b90d28146e5cf988477f62f3776f

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      a142637ef315b12c7a4fbd775d20aa0b.exe

    • Size

      158KB

    • MD5

      a142637ef315b12c7a4fbd775d20aa0b

    • SHA1

      501987446d082e356c412827736b5b1a2ed04b47

    • SHA256

      c9d747511a0384a1269928fb6486411d045616865ba88062e46d8307e01c780b

    • SHA512

      2b0175f57c996fd6d2313db124154a2b63491ae2da57ca0794e3875b2e40b450381dfaad0ac538e0ec1bd05d9881159f3c01b90d28146e5cf988477f62f3776f

    Score
    10/10
    njratevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks