Overview

overview

10

Static

static

1ri6vEaZ.exe

windows7_x64

10

1ri6vEaZ.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1ri6vEaZ.exe

  • Size

    23KB

  • Sample

    201124-5np1761t2e

  • MD5

    14302b2f2ea63fc602a20fd8e0843a01

  • SHA1

    4502a056326f9ee055f6d91934148a30608168b8

  • SHA256

    d6a23bd5941e939de4a0a6af6bb581aefa9fff47cd3d6d5cfa3d170c3a50d389

  • SHA512

    d0e953fe15254b0e94eb031e77c83c5f204c4d6278307a416e48fd489e17cf7b9cf964800456395fce54bdbd293a560f0f0bf2d306f95004c809f3ef2d850590

Score
10/10
njrathacked by ayoubotoevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed by ayouboto

C2

frifra.myq-see.com:5552

Mutex

9f7aaf2b008e1c7912a43cef67198b0a

Attributes
  • reg_key

    9f7aaf2b008e1c7912a43cef67198b0a

  • splitter

    |'|'|

Targets

    • Target

      1ri6vEaZ.exe

    • Size

      23KB

    • MD5

      14302b2f2ea63fc602a20fd8e0843a01

    • SHA1

      4502a056326f9ee055f6d91934148a30608168b8

    • SHA256

      d6a23bd5941e939de4a0a6af6bb581aefa9fff47cd3d6d5cfa3d170c3a50d389

    • SHA512

      d0e953fe15254b0e94eb031e77c83c5f204c4d6278307a416e48fd489e17cf7b9cf964800456395fce54bdbd293a560f0f0bf2d306f95004c809f3ef2d850590

    Score
    10/10
    njrathacked by ayoubotoevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks