Overview

overview

10

Static

static

c26209430e...81.exe

windows7-x64

8

c26209430e...81.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c26209430ec0480ee762132345f0f64de207043c67f4e5fcde9029ff8bff7c81

  • Size

    140KB

  • Sample

    221124-ex92msca3w

  • MD5

    c2fde55f2557395ce92ea32484244fb8

  • SHA1

    58f4037513ee86c630f0c2739f10e3aafca69aaf

  • SHA256

    c26209430ec0480ee762132345f0f64de207043c67f4e5fcde9029ff8bff7c81

  • SHA512

    63e0fa92b125931fbc93abe2ab24bd5a867bffff8a54182311a2c559bd71e73e1094355d9479ae1d42bde5426e7a7a014d457a0c0d757f9e1b4345ad1637dcad

  • SSDEEP

    1536:KQIxHDuZj8ywZoiHB11S/GGczJ0lE6C0YZ0w4tLBJzvwZazHUNdKe:yHaZieMz1SXlED0YZh4ZzvwITUNdKe

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      c26209430ec0480ee762132345f0f64de207043c67f4e5fcde9029ff8bff7c81

    • Size

      140KB

    • MD5

      c2fde55f2557395ce92ea32484244fb8

    • SHA1

      58f4037513ee86c630f0c2739f10e3aafca69aaf

    • SHA256

      c26209430ec0480ee762132345f0f64de207043c67f4e5fcde9029ff8bff7c81

    • SHA512

      63e0fa92b125931fbc93abe2ab24bd5a867bffff8a54182311a2c559bd71e73e1094355d9479ae1d42bde5426e7a7a014d457a0c0d757f9e1b4345ad1637dcad

    • SSDEEP

      1536:KQIxHDuZj8ywZoiHB11S/GGczJ0lE6C0YZ0w4tLBJzvwZazHUNdKe:yHaZieMz1SXlED0YZh4ZzvwITUNdKe

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks