Overview

overview

10

Static

static

814a0b12bf...00.exe

windows7_x64

10

814a0b12bf...00.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    814a0b12bfb5ecc8f4075386f0ae709ed5205e47f9b3507a5044d64e387ed400

  • Size

    129KB

  • Sample

    220129-gfdcfsedc4

  • MD5

    02ee963115af7db8b3ba7df8c8b53611

  • SHA1

    1e11a53ad9c20bb9fc3c7a9d7c35168189df1464

  • SHA256

    814a0b12bfb5ecc8f4075386f0ae709ed5205e47f9b3507a5044d64e387ed400

  • SHA512

    0bdbf2dda800dd65b98214d507cb954986b4ea732ca1ef4f319858ceb525163dea8ba651a74e7b0cdbb81e37285da3b5b8746b432be04d6c7ede683357275070

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      814a0b12bfb5ecc8f4075386f0ae709ed5205e47f9b3507a5044d64e387ed400

    • Size

      129KB

    • MD5

      02ee963115af7db8b3ba7df8c8b53611

    • SHA1

      1e11a53ad9c20bb9fc3c7a9d7c35168189df1464

    • SHA256

      814a0b12bfb5ecc8f4075386f0ae709ed5205e47f9b3507a5044d64e387ed400

    • SHA512

      0bdbf2dda800dd65b98214d507cb954986b4ea732ca1ef4f319858ceb525163dea8ba651a74e7b0cdbb81e37285da3b5b8746b432be04d6c7ede683357275070

    Score
    10/10
    njratevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks