Overview

overview

10

Static

static

09d0cd4748...17.exe

windows7_x64

8

09d0cd4748...17.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    09d0cd4748be6b5295590631c6eef84bc581263f5b51d0004822fa08fbb4fd17

  • Size

    157KB

  • Sample

    220520-3b459sgfb3

  • MD5

    5c90fb934cca08cbdbf45b0859ded3fe

  • SHA1

    49eb65e8e323fd4ed0e55b6e5f5a1feb62f9fd2a

  • SHA256

    09d0cd4748be6b5295590631c6eef84bc581263f5b51d0004822fa08fbb4fd17

  • SHA512

    4b3ee48b31c2e0f9692382085aa18c98f5e28097836d10da646619ed5990c8f056ffd06165e0c2a0737363c2ca96e72ed64b0e989145f8821a1edd3052277779

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      09d0cd4748be6b5295590631c6eef84bc581263f5b51d0004822fa08fbb4fd17

    • Size

      157KB

    • MD5

      5c90fb934cca08cbdbf45b0859ded3fe

    • SHA1

      49eb65e8e323fd4ed0e55b6e5f5a1feb62f9fd2a

    • SHA256

      09d0cd4748be6b5295590631c6eef84bc581263f5b51d0004822fa08fbb4fd17

    • SHA512

      4b3ee48b31c2e0f9692382085aa18c98f5e28097836d10da646619ed5990c8f056ffd06165e0c2a0737363c2ca96e72ed64b0e989145f8821a1edd3052277779

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks