Overview

overview

10

Static

static

9115ca488f...e1.exe

windows7_x64

10

9115ca488f...e1.exe

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    9115ca488f308a6f1f9ebf19a164b9e1.exe
  • Size 23KB
  • Sample201214-cte1atygh6
  • SHA256 4ddb173a67ca5a5ccce340d40afcbfae4bc7d929ab41c07a6972269c6c71348b
  • MD5 SHA1 SHA512
Score
10/10
njratalternative flash playeevasionpersistencetrojan

Malware Config

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • Alternative Flash Playe

C2

  • 552020.ddns.net:5552

Mutex

  • 0ce50ee3b687c9aef6488d6ebf87a549

Attributes
  • reg_key

    0ce50ee3b687c9aef6488d6ebf87a549

  • splitter

    |'|'|

Targets

    • Target
      9115ca488f308a6f1f9ebf19a164b9e1.exe
    • Size 23KB
    • SHA256 4ddb173a67ca5a5ccce340d40afcbfae4bc7d929ab41c07a6972269c6c71348b
    • MD5 SHA1 SHA512
    Score
    10/10
    njratalternative flash playeevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks