Overview

overview

10

Static

static

478fe433b3...d8.exe

windows7-x64

8

478fe433b3...d8.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    478fe433b3a3f27b8412dc2ee7f4b0058de70b678d448c6d0e6a6a658c93d2d8

  • Size

    27KB

  • Sample

    221004-clncdsgfdp

  • MD5

    38dfb8ddf418ad565f57d5aa393b5df0

  • SHA1

    2ecc8adf44df386d6f636539c90adfaa09657b22

  • SHA256

    478fe433b3a3f27b8412dc2ee7f4b0058de70b678d448c6d0e6a6a658c93d2d8

  • SHA512

    0ba4f3aac57f7c3f2c47b6108d2a5c8bec30908ab0eebfafec8f12b1cc5dba9c8506fb3725242e710fd7b7f02f2e1c30a4220193b9a5c2297d48b725f47771d9

  • SSDEEP

    768:zOPmL8HRL4IrJuH4nmc/kaAejGVommDd:zOPmLgh7NuemekXeqVjmDd

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      478fe433b3a3f27b8412dc2ee7f4b0058de70b678d448c6d0e6a6a658c93d2d8

    • Size

      27KB

    • MD5

      38dfb8ddf418ad565f57d5aa393b5df0

    • SHA1

      2ecc8adf44df386d6f636539c90adfaa09657b22

    • SHA256

      478fe433b3a3f27b8412dc2ee7f4b0058de70b678d448c6d0e6a6a658c93d2d8

    • SHA512

      0ba4f3aac57f7c3f2c47b6108d2a5c8bec30908ab0eebfafec8f12b1cc5dba9c8506fb3725242e710fd7b7f02f2e1c30a4220193b9a5c2297d48b725f47771d9

    • SSDEEP

      768:zOPmL8HRL4IrJuH4nmc/kaAejGVommDd:zOPmLgh7NuemekXeqVjmDd

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks