Overview

overview

10

Static

static

1

HEUR-Troja...49.exe

windows7-x64

8

HEUR-Troja...49.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    HEUR-Trojan.MSIL.Generic-201b4922c6b82b4ac349.exe

  • Size

    78KB

  • Sample

    230206-h44pzsfh7s

  • MD5

    f7aa7d4c186cb3982667ea9b7559ddf3

  • SHA1

    446466aedae6546584978e3343cd0fe9823add95

  • SHA256

    201b4922c6b82b4ac3498a8570ba1875982cc4cbbc5699882910748800dc15ed

  • SHA512

    267dbe00e4d5cb9b3013e1eb354ed618b612a3692d337b01aab5ee527648aa865a30f6932f7650b34fba363b9ea2be1d09f121bc125510c961e5448aabd55705

  • SSDEEP

    1536:H2SoJu8s5x2EgcQ4Pxcscy4MwJLGVls6URSmYWf2lyyN:WVAF/d3xc3M4kIAekN

Score
10/10
njratevasionpersistencetrojan

Malware Config

Targets

    • Target

      HEUR-Trojan.MSIL.Generic-201b4922c6b82b4ac349.exe

    • Size

      78KB

    • MD5

      f7aa7d4c186cb3982667ea9b7559ddf3

    • SHA1

      446466aedae6546584978e3343cd0fe9823add95

    • SHA256

      201b4922c6b82b4ac3498a8570ba1875982cc4cbbc5699882910748800dc15ed

    • SHA512

      267dbe00e4d5cb9b3013e1eb354ed618b612a3692d337b01aab5ee527648aa865a30f6932f7650b34fba363b9ea2be1d09f121bc125510c961e5448aabd55705

    • SSDEEP

      1536:H2SoJu8s5x2EgcQ4Pxcscy4MwJLGVls6URSmYWf2lyyN:WVAF/d3xc3M4kIAekN

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks