Overview

overview

10

Static

static

f9e1d60346...fb.exe

windows7_x64

10

f9e1d60346...fb.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f9e1d6034641cb0a7499c761999a8ce0b94be591312114b20998b881df37e8fb

  • Size

    170KB

  • Sample

    220128-281zfagaal

  • MD5

    32bcb3e725089e57c3a507f87b2a8dc1

  • SHA1

    a8116e41e7b551c4b8b619fee5a79ed39a8d2e8f

  • SHA256

    f9e1d6034641cb0a7499c761999a8ce0b94be591312114b20998b881df37e8fb

  • SHA512

    63f5079940b7205bebbc84914e8342d9018b830e27622cc3a70e1275acbb23c3c2fc81856955f932cbce812adc23ed38d665f57bb0287cbc47bca6e55e6a42da

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      f9e1d6034641cb0a7499c761999a8ce0b94be591312114b20998b881df37e8fb

    • Size

      170KB

    • MD5

      32bcb3e725089e57c3a507f87b2a8dc1

    • SHA1

      a8116e41e7b551c4b8b619fee5a79ed39a8d2e8f

    • SHA256

      f9e1d6034641cb0a7499c761999a8ce0b94be591312114b20998b881df37e8fb

    • SHA512

      63f5079940b7205bebbc84914e8342d9018b830e27622cc3a70e1275acbb23c3c2fc81856955f932cbce812adc23ed38d665f57bb0287cbc47bca6e55e6a42da

    Score
    10/10
    njratevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks