Overview

overview

10

Static

static

f7131d2389...c3.exe

windows7_x64

10

f7131d2389...c3.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f7131d238936a8c24ce71706bb8050338623377f4189a106b3361fd1ffc6cac3

  • Size

    40KB

  • Sample

    220128-3dwlxagbcj

  • MD5

    ab9227ef1d109dfd789c9bdeb46605a0

  • SHA1

    a9f1569c151195bfb32b2db0625085453aab69c3

  • SHA256

    f7131d238936a8c24ce71706bb8050338623377f4189a106b3361fd1ffc6cac3

  • SHA512

    6e204f7268af6df6f11e7b17ff9692a980d5abbfa23c7663e9779e7bceafc1cd22988b9163991c1916542e8c6ddd329c27b0e992e4b2f83d08d378131d1b8ac7

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      f7131d238936a8c24ce71706bb8050338623377f4189a106b3361fd1ffc6cac3

    • Size

      40KB

    • MD5

      ab9227ef1d109dfd789c9bdeb46605a0

    • SHA1

      a9f1569c151195bfb32b2db0625085453aab69c3

    • SHA256

      f7131d238936a8c24ce71706bb8050338623377f4189a106b3361fd1ffc6cac3

    • SHA512

      6e204f7268af6df6f11e7b17ff9692a980d5abbfa23c7663e9779e7bceafc1cd22988b9163991c1916542e8c6ddd329c27b0e992e4b2f83d08d378131d1b8ac7

    Score
    10/10
    njratevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks