Overview

overview

10

Static

static

5

38c19d51d8...00.exe

windows7-x64

10

38c19d51d8...00.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    38c19d51d82797b47f3b06e50c6ea197bdda02ac3d1a22edf67023de77c1d700

  • Size

    893KB

  • Sample

    221127-xjpgwsef7x

  • MD5

    431cdf896cc59d2595cebd9efc5442f7

  • SHA1

    6f8645755daf30ed9ac5d8e173c9320d9806bc7f

  • SHA256

    38c19d51d82797b47f3b06e50c6ea197bdda02ac3d1a22edf67023de77c1d700

  • SHA512

    5d0fea84950f08a87dcb12950e9813fd7ea92b23a767cd13e0307d509560cb0c5b05aacabd42e8dad1670ba3261d4a7cdc88fb0106e7fc89494c691ae0eeb2e1

  • SSDEEP

    12288:Ntb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgadLHT6ORnww6A:Ntb20pkaCqT5TBWgNQ7ady3w6A

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      38c19d51d82797b47f3b06e50c6ea197bdda02ac3d1a22edf67023de77c1d700

    • Size

      893KB

    • MD5

      431cdf896cc59d2595cebd9efc5442f7

    • SHA1

      6f8645755daf30ed9ac5d8e173c9320d9806bc7f

    • SHA256

      38c19d51d82797b47f3b06e50c6ea197bdda02ac3d1a22edf67023de77c1d700

    • SHA512

      5d0fea84950f08a87dcb12950e9813fd7ea92b23a767cd13e0307d509560cb0c5b05aacabd42e8dad1670ba3261d4a7cdc88fb0106e7fc89494c691ae0eeb2e1

    • SSDEEP

      12288:Ntb20Qc3lT7af41ePBRYuQLKpqeUhbTv5OFgNuPPpHSgadLHT6ORnww6A:Ntb20pkaCqT5TBWgNQ7ady3w6A

    Score
    10/10
    njratevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks