Overview

overview

10

Static

static

a4fee83713...66.exe

windows7-x64

8

a4fee83713...66.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a4fee83713aa0aa22099e7531d1e875eaa3f3e2b7e921721b79c5a68511d8b66

  • Size

    177KB

  • Sample

    221124-eyb61agg54

  • MD5

    adad59681c52a7e1490d8b72457028fb

  • SHA1

    821080dd77cb2b682be93e4ec879dcdf8a47872b

  • SHA256

    a4fee83713aa0aa22099e7531d1e875eaa3f3e2b7e921721b79c5a68511d8b66

  • SHA512

    f6b715246cb77f495f472109b5cb7c90645d6ed26caddf8fbe74e72066a7608d22f3f213c719208c06d7711364f2e40073ecf68acdc36218826b9fbe096bbfe7

  • SSDEEP

    1536:uWUHZK25eW9V9ge1EBjyO3lg7yZ/nzzGyQCAhtwjIVhmroF:udHZK2jEe1Ej4mPzay8YjIbmMF

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      a4fee83713aa0aa22099e7531d1e875eaa3f3e2b7e921721b79c5a68511d8b66

    • Size

      177KB

    • MD5

      adad59681c52a7e1490d8b72457028fb

    • SHA1

      821080dd77cb2b682be93e4ec879dcdf8a47872b

    • SHA256

      a4fee83713aa0aa22099e7531d1e875eaa3f3e2b7e921721b79c5a68511d8b66

    • SHA512

      f6b715246cb77f495f472109b5cb7c90645d6ed26caddf8fbe74e72066a7608d22f3f213c719208c06d7711364f2e40073ecf68acdc36218826b9fbe096bbfe7

    • SSDEEP

      1536:uWUHZK25eW9V9ge1EBjyO3lg7yZ/nzzGyQCAhtwjIVhmroF:udHZK2jEe1Ej4mPzay8YjIbmMF

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks