Overview

overview

10

Static

static

8f438a9b94...72.exe

windows7-x64

8

8f438a9b94...72.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f438a9b94cb219d14a9d9d6172d81b9600b876acb4a4e364ae7ed84522af372

  • Size

    38KB

  • Sample

    221020-le5sjaffb7

  • MD5

    80669037be14749384c364424db64fd0

  • SHA1

    df7d67cff05d6b905660c70907187f87cad411d5

  • SHA256

    8f438a9b94cb219d14a9d9d6172d81b9600b876acb4a4e364ae7ed84522af372

  • SHA512

    681cefdac862bd33ba016ae317c92841758c85a13d6a987191e69ab24a700ca501222f87e36a4b277fd736df88b068675f1a98b1c51a28ff5261144149bc8394

  • SSDEEP

    768:uFDKZIRxEAo/Lifrz/YaqeUNNqifW5ROj10Au4pc24yjhxl:uxqmfv/Y/tqifW/Oj10Wc2RVr

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      8f438a9b94cb219d14a9d9d6172d81b9600b876acb4a4e364ae7ed84522af372

    • Size

      38KB

    • MD5

      80669037be14749384c364424db64fd0

    • SHA1

      df7d67cff05d6b905660c70907187f87cad411d5

    • SHA256

      8f438a9b94cb219d14a9d9d6172d81b9600b876acb4a4e364ae7ed84522af372

    • SHA512

      681cefdac862bd33ba016ae317c92841758c85a13d6a987191e69ab24a700ca501222f87e36a4b277fd736df88b068675f1a98b1c51a28ff5261144149bc8394

    • SSDEEP

      768:uFDKZIRxEAo/Lifrz/YaqeUNNqifW5ROj10Au4pc24yjhxl:uxqmfv/Y/tqifW/Oj10Wc2RVr

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks