Overview

overview

10

Static

static

aebe14fe1d...8c.exe

windows7-x64

8

aebe14fe1d...8c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aebe14fe1dfbd89848f51831dc53f2e0df55908783959b57eec070c2a1ddc98c

  • Size

    383KB

  • Sample

    221126-klkkhaab2x

  • MD5

    ee67fdd8f9b5dffe1d0d123caf3032f7

  • SHA1

    a8adc23fae4182ec697f0bf313e5f6a35a7fb938

  • SHA256

    aebe14fe1dfbd89848f51831dc53f2e0df55908783959b57eec070c2a1ddc98c

  • SHA512

    0b72f4eaec920a45672ec3463075adc9f92fcfb694694362fbdfb807b9e4af2222a06ac8c472ea5449e8d154b2e739f0e1867986236614336cd0b2351123a391

  • SSDEEP

    6144:lvLnQs/GKl8uHsdcPZBKsthXOb5klzPYbT9l4:MUBRXOb5klzPYbT9l

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      aebe14fe1dfbd89848f51831dc53f2e0df55908783959b57eec070c2a1ddc98c

    • Size

      383KB

    • MD5

      ee67fdd8f9b5dffe1d0d123caf3032f7

    • SHA1

      a8adc23fae4182ec697f0bf313e5f6a35a7fb938

    • SHA256

      aebe14fe1dfbd89848f51831dc53f2e0df55908783959b57eec070c2a1ddc98c

    • SHA512

      0b72f4eaec920a45672ec3463075adc9f92fcfb694694362fbdfb807b9e4af2222a06ac8c472ea5449e8d154b2e739f0e1867986236614336cd0b2351123a391

    • SSDEEP

      6144:lvLnQs/GKl8uHsdcPZBKsthXOb5klzPYbT9l4:MUBRXOb5klzPYbT9l

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks