Overview

overview

10

Static

static

6c106b136a...88.exe

windows7-x64

8

6c106b136a...88.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6c106b136a649b3df68160d2351d23b459842c212f735c6a163cef14f0306888

  • Size

    160KB

  • Sample

    221003-bhp65saba2

  • MD5

    5ddb5e008e91c6332831033d3b01e760

  • SHA1

    5f8698a46df82a3a16ef23cb2ccb3f7940a40435

  • SHA256

    6c106b136a649b3df68160d2351d23b459842c212f735c6a163cef14f0306888

  • SHA512

    c08f4d859eec49df340cc9b97091e5f713f590d169c2b1eef728c77b971fd816a011753bf0de700155f52a16cea3ff29cb78bf609c77381a7bd7138f232f055f

  • SSDEEP

    3072:U/eylEPKs1aNiEXG6K9f+SCDbplnYzo+kOv3RmJM9F:VJ1ynIG3zYzoOPRm

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      6c106b136a649b3df68160d2351d23b459842c212f735c6a163cef14f0306888

    • Size

      160KB

    • MD5

      5ddb5e008e91c6332831033d3b01e760

    • SHA1

      5f8698a46df82a3a16ef23cb2ccb3f7940a40435

    • SHA256

      6c106b136a649b3df68160d2351d23b459842c212f735c6a163cef14f0306888

    • SHA512

      c08f4d859eec49df340cc9b97091e5f713f590d169c2b1eef728c77b971fd816a011753bf0de700155f52a16cea3ff29cb78bf609c77381a7bd7138f232f055f

    • SSDEEP

      3072:U/eylEPKs1aNiEXG6K9f+SCDbplnYzo+kOv3RmJM9F:VJ1ynIG3zYzoOPRm

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks