Overview

overview

10

Static

static

79d00c6728...0f.exe

windows7-x64

8

79d00c6728...0f.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    79d00c6728a4e35bca0d3f0b93ffbfd94c0e0a7e621d3452fbe57d9e3796360f

  • Size

    433KB

  • Sample

    221127-16mtcsgd7z

  • MD5

    ef7eaca47342490fe4c08549a4e45bc3

  • SHA1

    b59ca9237410c94d078ea49a7c6f2d3519c04bb9

  • SHA256

    79d00c6728a4e35bca0d3f0b93ffbfd94c0e0a7e621d3452fbe57d9e3796360f

  • SHA512

    cfcb94292803909cfecebcb3469a6211ee828c4a1cc3e3f89b07420388aa378ed49f7385ec34d9ad2b5726137a87055a9260835b4b7a595f80afb398e61715c7

  • SSDEEP

    12288:JF6kN+Db1S1EPTLqsJFLknK86mOnWFbZZl3:JF6kcnU1E7L5TknKNmftZZN

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      79d00c6728a4e35bca0d3f0b93ffbfd94c0e0a7e621d3452fbe57d9e3796360f

    • Size

      433KB

    • MD5

      ef7eaca47342490fe4c08549a4e45bc3

    • SHA1

      b59ca9237410c94d078ea49a7c6f2d3519c04bb9

    • SHA256

      79d00c6728a4e35bca0d3f0b93ffbfd94c0e0a7e621d3452fbe57d9e3796360f

    • SHA512

      cfcb94292803909cfecebcb3469a6211ee828c4a1cc3e3f89b07420388aa378ed49f7385ec34d9ad2b5726137a87055a9260835b4b7a595f80afb398e61715c7

    • SSDEEP

      12288:JF6kN+Db1S1EPTLqsJFLknK86mOnWFbZZl3:JF6kcnU1E7L5TknKNmftZZN

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks