Overview

overview

10

Static

static

10

New Client.exe

windows7-x64

10

New Client.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New Client.exe

  • Size

    164KB

  • Sample

    241021-yeqptssdng

  • MD5

    3020c25093319b8dbea0354a8c819790

  • SHA1

    7b1ba6774874cb8f58143da3ef48a4539c89679d

  • SHA256

    a80c5e926b48f4263ce1269ea307ec45d1ccae93f9e1e21f3922fbb022c87b59

  • SHA512

    1a4df5ed49a4041e3f9f93d527d389233dce44657a31ce06f3a22c98ffde4023c6c73a851aab79afff9d4e5d5f8934d6928350fc9e5cb295702e3c1d504f7893

  • SSDEEP

    3072:4aZr/YQa8KwW+/Lvcv89AN2VhR9HNr7DUE1/Y3QbTQ241h66elaH:4auMLEv89ANihRrrHnNYgbTghN

Score
10/10
njratdiscoverypersistencetrojan

Malware Config

Targets

    • Target

      New Client.exe

    • Size

      164KB

    • MD5

      3020c25093319b8dbea0354a8c819790

    • SHA1

      7b1ba6774874cb8f58143da3ef48a4539c89679d

    • SHA256

      a80c5e926b48f4263ce1269ea307ec45d1ccae93f9e1e21f3922fbb022c87b59

    • SHA512

      1a4df5ed49a4041e3f9f93d527d389233dce44657a31ce06f3a22c98ffde4023c6c73a851aab79afff9d4e5d5f8934d6928350fc9e5cb295702e3c1d504f7893

    • SSDEEP

      3072:4aZr/YQa8KwW+/Lvcv89AN2VhR9HNr7DUE1/Y3QbTQ241h66elaH:4auMLEv89ANihRrrHnNYgbTghN

    Score
    10/10
    njratdiscoverypersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks