Overview

overview

10

Static

static

3

5.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    5.exe

  • Size

    10.3MB

  • Sample

    231031-fynepsag85

  • MD5

    b739c3eba37aa9999fb2d15ab5b9c680

  • SHA1

    bb18cc561805efa38545310057bcae4e894d3817

  • SHA256

    4d3583917fb1f539f92f945f0f298b2c1766ac27086275600eab721b8e9fbd90

  • SHA512

    0259b599a7e37426383184110aa828d0797875bab1925186b5b0ca0cb99ed2ae2bceb31f5c83ca3a8ba890bf86bb8cfa75f58d80db3b4ae710828f8ffb36c1ea

  • SSDEEP

    196608:56wcPit+w7T+yuSLoGUpTKQ8LY+TRQf3goX3yCJdpHt:5jSKd/+yuQoGUlQepyCJ

Score
10/10
njrattrojan

Malware Config

Targets

    • Target

      5.exe

    • Size

      10.3MB

    • MD5

      b739c3eba37aa9999fb2d15ab5b9c680

    • SHA1

      bb18cc561805efa38545310057bcae4e894d3817

    • SHA256

      4d3583917fb1f539f92f945f0f298b2c1766ac27086275600eab721b8e9fbd90

    • SHA512

      0259b599a7e37426383184110aa828d0797875bab1925186b5b0ca0cb99ed2ae2bceb31f5c83ca3a8ba890bf86bb8cfa75f58d80db3b4ae710828f8ffb36c1ea

    • SSDEEP

      196608:56wcPit+w7T+yuSLoGUpTKQ8LY+TRQf3goX3yCJdpHt:5jSKd/+yuQoGUlQepyCJ

    Score
    10/10
    njrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks