Overview

overview

10

Static

static

f37f92a17b...23.exe

windows7-x64

10

f37f92a17b...23.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23

  • Size

    228KB

  • Sample

    221030-nvjlcahcg4

  • MD5

    83b10470cef172aef511a30d31c668aa

  • SHA1

    c5cb4ca62712f8c9f51c14a08d92b2d6706a0892

  • SHA256

    f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23

  • SHA512

    465a0b6f199982c3f2451c93c23066a0390d8e9733477594f217cdf908950d1462f510b10690df03b5790265defc5efcd222c7853344ba1378ab1a5bb74cd918

  • SSDEEP

    3072:hnK4i05Pdj0OfV3BpR9m4PzSQkeeAaF+I7xrXlPb3+HUHFiVeui:Bi055l/g4bOAART+HUHFi+

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23

    • Size

      228KB

    • MD5

      83b10470cef172aef511a30d31c668aa

    • SHA1

      c5cb4ca62712f8c9f51c14a08d92b2d6706a0892

    • SHA256

      f37f92a17bd17ce61231f6ba58643692ba99b4b311d7e4447255ee60619cfc23

    • SHA512

      465a0b6f199982c3f2451c93c23066a0390d8e9733477594f217cdf908950d1462f510b10690df03b5790265defc5efcd222c7853344ba1378ab1a5bb74cd918

    • SSDEEP

      3072:hnK4i05Pdj0OfV3BpR9m4PzSQkeeAaF+I7xrXlPb3+HUHFiVeui:Bi055l/g4bOAART+HUHFi+

    Score
    10/10
    njratevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks