Overview

overview

10

Static

static

bfc5dab656...01.exe

windows7-x64

8

bfc5dab656...01.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    bfc5dab65631a386a0e5856b7d4ec416b51b48a2d77b5311fef13c3693dc3d01

  • Size

    1.4MB

  • Sample

    221128-ew2zmsab8w

  • MD5

    00d78814069d382b91753539d23a2eaf

  • SHA1

    0a3cf71ebd46462022778516b5b31d1c0663bfc6

  • SHA256

    bfc5dab65631a386a0e5856b7d4ec416b51b48a2d77b5311fef13c3693dc3d01

  • SHA512

    bbcedc40b3451fd5536e4e9613358c6e1981f9e14b0a43409a4e418a6a7d510d197501cafa52f8fac0500d985c2eeb16512669a162d79b07a0c19cf0b45226ae

  • SSDEEP

    24576:hKUddJLyKWwRQA1xDXCM8RKvfJ/Xonp/SO/D5O:hKUJLyKdmA1xDXCM8AJwp/SO/NO

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      bfc5dab65631a386a0e5856b7d4ec416b51b48a2d77b5311fef13c3693dc3d01

    • Size

      1.4MB

    • MD5

      00d78814069d382b91753539d23a2eaf

    • SHA1

      0a3cf71ebd46462022778516b5b31d1c0663bfc6

    • SHA256

      bfc5dab65631a386a0e5856b7d4ec416b51b48a2d77b5311fef13c3693dc3d01

    • SHA512

      bbcedc40b3451fd5536e4e9613358c6e1981f9e14b0a43409a4e418a6a7d510d197501cafa52f8fac0500d985c2eeb16512669a162d79b07a0c19cf0b45226ae

    • SSDEEP

      24576:hKUddJLyKWwRQA1xDXCM8RKvfJ/Xonp/SO/D5O:hKUJLyKdmA1xDXCM8AJwp/SO/NO

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks