Overview

overview

10

Static

static

1a54390bf4...16.exe

windows7-x64

8

1a54390bf4...16.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    1a54390bf4f97eabc52bed5f3d698efb57ee285e789284993233c2a5db944d16

  • Size

    1.5MB

  • Sample

    221127-mlvftaec6x

  • MD5

    15e5b2411f2f7ab042edd30fa9af6237

  • SHA1

    bb5787e864dc3f0a3048e81f5616cce66b3c4de5

  • SHA256

    1a54390bf4f97eabc52bed5f3d698efb57ee285e789284993233c2a5db944d16

  • SHA512

    9e921e113bdc269633caa8c044960147f94a6507c5e6d910a50d1c01d456aeb5e35cdc86c5aad7b4b247251ab161073e2a997394976168a889fea9f8e245f1f0

  • SSDEEP

    24576:jGmAQCMjaSfT3qg/JdrKuWbOWVkebKcg1JR16SOqu5JogAOUbJN2rElKnKkzOF/Y:jG+CM2SfT3qgBQ241c4tP5JogAOUFN2N

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      1a54390bf4f97eabc52bed5f3d698efb57ee285e789284993233c2a5db944d16

    • Size

      1.5MB

    • MD5

      15e5b2411f2f7ab042edd30fa9af6237

    • SHA1

      bb5787e864dc3f0a3048e81f5616cce66b3c4de5

    • SHA256

      1a54390bf4f97eabc52bed5f3d698efb57ee285e789284993233c2a5db944d16

    • SHA512

      9e921e113bdc269633caa8c044960147f94a6507c5e6d910a50d1c01d456aeb5e35cdc86c5aad7b4b247251ab161073e2a997394976168a889fea9f8e245f1f0

    • SSDEEP

      24576:jGmAQCMjaSfT3qg/JdrKuWbOWVkebKcg1JR16SOqu5JogAOUbJN2rElKnKkzOF/Y:jG+CM2SfT3qgBQ241c4tP5JogAOUFN2N

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks