Overview

overview

10

Static

static

8

4fff64c207...3b.exe

windows7-x64

10

4fff64c207...3b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4fff64c207d1d0ebe4073f120bb99720a90b79a8b9558e316f80b926c56ebf3b

  • Size

    325KB

  • Sample

    221128-wye2bsba9x

  • MD5

    8bbb3b4c01554e0ff1a618554c067dc3

  • SHA1

    294d26f917ed996c1f8aae3a57f723666cc49843

  • SHA256

    4fff64c207d1d0ebe4073f120bb99720a90b79a8b9558e316f80b926c56ebf3b

  • SHA512

    5454ae34b4bd6dfbe896a91a7d41197dcad048ed4b2aa8286dad5f2ed70fd41e5799815175aba059c4ca96997dd0e11ed30a48adb0f0486d7e656a560dab428c

  • SSDEEP

    6144:XuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLcnSR51yB3l1G:e6Wq4aaE6KwyF5L0Y2D1PqLt5sBvG

Score
10/10
njratevasionpersistencetrojanupx

Malware Config

Targets

    • Target

      4fff64c207d1d0ebe4073f120bb99720a90b79a8b9558e316f80b926c56ebf3b

    • Size

      325KB

    • MD5

      8bbb3b4c01554e0ff1a618554c067dc3

    • SHA1

      294d26f917ed996c1f8aae3a57f723666cc49843

    • SHA256

      4fff64c207d1d0ebe4073f120bb99720a90b79a8b9558e316f80b926c56ebf3b

    • SHA512

      5454ae34b4bd6dfbe896a91a7d41197dcad048ed4b2aa8286dad5f2ed70fd41e5799815175aba059c4ca96997dd0e11ed30a48adb0f0486d7e656a560dab428c

    • SSDEEP

      6144:XuIlWqB+ihabs7Ch9KwyF5LeLodp2D1Mmakda0qLcnSR51yB3l1G:e6Wq4aaE6KwyF5L0Y2D1PqLt5sBvG

    Score
    10/10
    njratevasionpersistencetrojanupx

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks