Overview

overview

10

Static

static

5af30be7a6...f9.exe

windows7-x64

10

5af30be7a6...f9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5af30be7a6a46eb6fb41d2afe308246ec7d175c2b909f5c455f89ba6c41e28f9

  • Size

    126KB

  • Sample

    221125-jprybaca44

  • MD5

    9421d7d2040766d4936991a7e77e7ef8

  • SHA1

    bc60ddd04c8609601b632e60ad2dfc12192210e7

  • SHA256

    5af30be7a6a46eb6fb41d2afe308246ec7d175c2b909f5c455f89ba6c41e28f9

  • SHA512

    4f7fb1ffd162d4960041bdd5d0b36cf19021b94485601d4ff8b6acd2e541f4698ed589f548c922f0ae6af25204aa260241634b1ee7d624d11c62478fca408864

  • SSDEEP

    3072:aNc+n2md+C1W50vmTv9Z3KFFPloxnLZxQFG+s2tU:aNb7Ok4Z3KPPl2baG+nt

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      5af30be7a6a46eb6fb41d2afe308246ec7d175c2b909f5c455f89ba6c41e28f9

    • Size

      126KB

    • MD5

      9421d7d2040766d4936991a7e77e7ef8

    • SHA1

      bc60ddd04c8609601b632e60ad2dfc12192210e7

    • SHA256

      5af30be7a6a46eb6fb41d2afe308246ec7d175c2b909f5c455f89ba6c41e28f9

    • SHA512

      4f7fb1ffd162d4960041bdd5d0b36cf19021b94485601d4ff8b6acd2e541f4698ed589f548c922f0ae6af25204aa260241634b1ee7d624d11c62478fca408864

    • SSDEEP

      3072:aNc+n2md+C1W50vmTv9Z3KFFPloxnLZxQFG+s2tU:aNb7Ok4Z3KPPl2baG+nt

    Score
    10/10
    njratevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks