Overview

overview

10

Static

static

59f8f2d31c...06.exe

windows7-x64

8

59f8f2d31c...06.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    59f8f2d31c3b6af4416e4a8de50f3fb93a07b5b1fc089c5fbf8f971c1f858306

  • Size

    119KB

  • Sample

    221003-b8cnqscfhk

  • MD5

    6fabf8dc37c601c9195c46da57484ce0

  • SHA1

    302b9373860b179d94d334ea7db9c89c48d8e5e4

  • SHA256

    59f8f2d31c3b6af4416e4a8de50f3fb93a07b5b1fc089c5fbf8f971c1f858306

  • SHA512

    6acfb42c0b7a57de527be0df66b5b3e87d46d444e89012cabc3313dfd852e3dd1d4867f08ef5430e4275bf5f8ec091b246b86b96af24145038885918944ba807

  • SSDEEP

    1536:v6quQ2V0CRa0XVs9iIH1NOl8HHuRhFLDW3VRqLw1QiN41D37qDO:yq12VNa1qCoXDgV31G6O

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      59f8f2d31c3b6af4416e4a8de50f3fb93a07b5b1fc089c5fbf8f971c1f858306

    • Size

      119KB

    • MD5

      6fabf8dc37c601c9195c46da57484ce0

    • SHA1

      302b9373860b179d94d334ea7db9c89c48d8e5e4

    • SHA256

      59f8f2d31c3b6af4416e4a8de50f3fb93a07b5b1fc089c5fbf8f971c1f858306

    • SHA512

      6acfb42c0b7a57de527be0df66b5b3e87d46d444e89012cabc3313dfd852e3dd1d4867f08ef5430e4275bf5f8ec091b246b86b96af24145038885918944ba807

    • SSDEEP

      1536:v6quQ2V0CRa0XVs9iIH1NOl8HHuRhFLDW3VRqLw1QiN41D37qDO:yq12VNa1qCoXDgV31G6O

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks