Overview

overview

10

Static

static

93b20d93a7...3a.exe

windows7-x64

8

93b20d93a7...3a.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    93b20d93a7141b2d0339d3be40278b6959e9d7e086e5da1d0a864bcf4c59fb3a

  • Size

    281KB

  • Sample

    221127-vmp7gsdf23

  • MD5

    f86a9775bc60fac9fc08a50f49f86580

  • SHA1

    a770948ca9d1d9b6d1ac74788fe2538b087526db

  • SHA256

    93b20d93a7141b2d0339d3be40278b6959e9d7e086e5da1d0a864bcf4c59fb3a

  • SHA512

    2a2a96812358d3cf63f4ec090a93d7fd030b7fe4191bba4394c27ad089e20cc6a9dfc744e671c72298a4744c3dd559599f250f546110662c8d5175a8bbdcf944

  • SSDEEP

    768:2IvCOcOvSLaZ1UaZ1/GJGNxjRuSLA7CvUH8D8Fg9Xx5tw1F:X6ESW/b//GIrjR5LWNZC9XpwP

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      93b20d93a7141b2d0339d3be40278b6959e9d7e086e5da1d0a864bcf4c59fb3a

    • Size

      281KB

    • MD5

      f86a9775bc60fac9fc08a50f49f86580

    • SHA1

      a770948ca9d1d9b6d1ac74788fe2538b087526db

    • SHA256

      93b20d93a7141b2d0339d3be40278b6959e9d7e086e5da1d0a864bcf4c59fb3a

    • SHA512

      2a2a96812358d3cf63f4ec090a93d7fd030b7fe4191bba4394c27ad089e20cc6a9dfc744e671c72298a4744c3dd559599f250f546110662c8d5175a8bbdcf944

    • SSDEEP

      768:2IvCOcOvSLaZ1UaZ1/GJGNxjRuSLA7CvUH8D8Fg9Xx5tw1F:X6ESW/b//GIrjR5LWNZC9XpwP

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks