Overview

overview

10

Static

static

72611A2A7D...03.exe

windows7_x64

10

72611A2A7D...03.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    72611A2A7DB8978D61F2D8659CD56C0595D96AC7FBB03.exe

  • Size

    158KB

  • Sample

    211228-rwallsdhd4

  • MD5

    d682f703d4b78ad2c57d3fc91e40df9b

  • SHA1

    49dfe802bf98c59eff10dbe8ec360ed53114bb6a

  • SHA256

    72611a2a7db8978d61f2d8659cd56c0595d96ac7fbb03adcc6000e40760062e7

  • SHA512

    384e5269ba21c749c9d320688d866e2047891744d4059767fb7e9230908016b9fc12fda4df20647555f6e68fafc5ffe2cbe0b780049de8c76c275c7cdb83a5c1

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      72611A2A7DB8978D61F2D8659CD56C0595D96AC7FBB03.exe

    • Size

      158KB

    • MD5

      d682f703d4b78ad2c57d3fc91e40df9b

    • SHA1

      49dfe802bf98c59eff10dbe8ec360ed53114bb6a

    • SHA256

      72611a2a7db8978d61f2d8659cd56c0595d96ac7fbb03adcc6000e40760062e7

    • SHA512

      384e5269ba21c749c9d320688d866e2047891744d4059767fb7e9230908016b9fc12fda4df20647555f6e68fafc5ffe2cbe0b780049de8c76c275c7cdb83a5c1

    Score
    10/10
    njratevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks