Overview

overview

10

Static

static

3

0953c0bbb3...5a.exe

windows7-x64

10

0953c0bbb3...5a.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    0953c0bbb38835507f967eee82e6182064e9ca1cc9abeb5eb576ea0f9322a55a

  • Size

    220KB

  • Sample

    240312-v1fj7sgg54

  • MD5

    eea82c5de6b8bb79f4b283f236e36eb5

  • SHA1

    53254d4ed10f77d4d79969c555d373669f26bd72

  • SHA256

    0953c0bbb38835507f967eee82e6182064e9ca1cc9abeb5eb576ea0f9322a55a

  • SHA512

    1bfb359f720b456adee714c0f8cf4f981fcdc16c14f16660fd318d9dd0beab6e822c8d5e4e05bd2d19e54fe05a3dbb0768bc16901f77f7daceaee31f2db56d7c

  • SSDEEP

    3072:WpXfjxcIDL1oXZedxSRsAfmotfZGp+j4Rp+lwLn6h9edeYOiJJEIXbrDyTL4v:WRoa0BVwp+8Oucedv3JJEILrWH

Score
10/10
njratpersistencetrojan

Malware Config

Targets

    • Target

      0953c0bbb38835507f967eee82e6182064e9ca1cc9abeb5eb576ea0f9322a55a

    • Size

      220KB

    • MD5

      eea82c5de6b8bb79f4b283f236e36eb5

    • SHA1

      53254d4ed10f77d4d79969c555d373669f26bd72

    • SHA256

      0953c0bbb38835507f967eee82e6182064e9ca1cc9abeb5eb576ea0f9322a55a

    • SHA512

      1bfb359f720b456adee714c0f8cf4f981fcdc16c14f16660fd318d9dd0beab6e822c8d5e4e05bd2d19e54fe05a3dbb0768bc16901f77f7daceaee31f2db56d7c

    • SSDEEP

      3072:WpXfjxcIDL1oXZedxSRsAfmotfZGp+j4Rp+lwLn6h9edeYOiJJEIXbrDyTL4v:WRoa0BVwp+8Oucedv3JJEILrWH

    Score
    10/10
    njratpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks