Overview

overview

10

Static

static

d368b4e80e...94.exe

windows7-x64

1

d368b4e80e...94.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    d368b4e80e3cb21ee0d15dff0683d4e2e2d2befb457c11855d1109bc7cf0cf94

  • Size

    239KB

  • Sample

    221029-hpcb7afeem

  • MD5

    c7f86ef4b9716ee685d7c57fdfe77dde

  • SHA1

    20cbc89048f288c6a5beaa2fc8eefba05e95219b

  • SHA256

    d368b4e80e3cb21ee0d15dff0683d4e2e2d2befb457c11855d1109bc7cf0cf94

  • SHA512

    ac7597b2d90acc48aad1eb81be53e888ff424b96d826a22750bf6a5ba374d77bf62f38f66e13de26baaea50f737d06d661ff1ca9ad34b3755b17ad2d77c8f848

  • SSDEEP

    6144:V7wAAEBErXrvBCHNOnAXoqXs8RzuKECTojhso1kUJUHCWm:oEBWv214qFziC0jv1kUui

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      d368b4e80e3cb21ee0d15dff0683d4e2e2d2befb457c11855d1109bc7cf0cf94

    • Size

      239KB

    • MD5

      c7f86ef4b9716ee685d7c57fdfe77dde

    • SHA1

      20cbc89048f288c6a5beaa2fc8eefba05e95219b

    • SHA256

      d368b4e80e3cb21ee0d15dff0683d4e2e2d2befb457c11855d1109bc7cf0cf94

    • SHA512

      ac7597b2d90acc48aad1eb81be53e888ff424b96d826a22750bf6a5ba374d77bf62f38f66e13de26baaea50f737d06d661ff1ca9ad34b3755b17ad2d77c8f848

    • SSDEEP

      6144:V7wAAEBErXrvBCHNOnAXoqXs8RzuKECTojhso1kUJUHCWm:oEBWv214qFziC0jv1kUui

    Score
    10/10
    njratevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks