Overview

overview

10

Static

static

67904a8462...32.exe

windows7-x64

8

67904a8462...32.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    67904a8462b88dcadaba4f52b40cb124ae53b89d34ef46ba08c7094f9b471f32

  • Size

    143KB

  • Sample

    221124-j2a6bsaf36

  • MD5

    0caa23cba1221ab7cae23aa9ca4e5872

  • SHA1

    18bf892854b9227e2346fe869bf5fc637b6c96fc

  • SHA256

    67904a8462b88dcadaba4f52b40cb124ae53b89d34ef46ba08c7094f9b471f32

  • SHA512

    d9bb6d0680cf3e700f77f80538c9cfa99ceb6db7aaddd24dca01040b7e84214954941f3d3f35ad8cdb7db5d4a9c5e437f1fd61033f650e91470c72dff2d90dab

  • SSDEEP

    3072:0S71DshD/Y2xS8BwfraUtszUEfBfNQF8gHmuTEtp:OhDA2xhGjO6Fvm8

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      67904a8462b88dcadaba4f52b40cb124ae53b89d34ef46ba08c7094f9b471f32

    • Size

      143KB

    • MD5

      0caa23cba1221ab7cae23aa9ca4e5872

    • SHA1

      18bf892854b9227e2346fe869bf5fc637b6c96fc

    • SHA256

      67904a8462b88dcadaba4f52b40cb124ae53b89d34ef46ba08c7094f9b471f32

    • SHA512

      d9bb6d0680cf3e700f77f80538c9cfa99ceb6db7aaddd24dca01040b7e84214954941f3d3f35ad8cdb7db5d4a9c5e437f1fd61033f650e91470c72dff2d90dab

    • SSDEEP

      3072:0S71DshD/Y2xS8BwfraUtszUEfBfNQF8gHmuTEtp:OhDA2xhGjO6Fvm8

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks