Overview

overview

10

Static

static

VPekxMtU.exe

windows7_x64

10

VPekxMtU.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    VPekxMtU.exe

  • Size

    23KB

  • Sample

    201225-2ygwzbe6fn

  • MD5

    f0648c9a052f6709a419fcb293edfd51

  • SHA1

    4c06fd1436794ccb4852cd086bc21c54c5ec53b0

  • SHA256

    637c5a6da12669b77450722407c7b63a057e10b5b4f43e6b2ae5a833e9b721e4

  • SHA512

    d856d260bc9a041674fc1b041204b53b8f48d30b56ed7450a6a1a0d6a07352a002192d60ce42a08f506f57fab6390f000974f36133ae4d323e436e6b92f132bd

Score
10/10
njrathackedevasionpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

nonspam.hopto.org:1177

Mutex

d190b0faf733c7f5258ca76c3c3a2eb6

Attributes
  • reg_key

    d190b0faf733c7f5258ca76c3c3a2eb6

  • splitter

    |'|'|

Targets

    • Target

      VPekxMtU.exe

    • Size

      23KB

    • MD5

      f0648c9a052f6709a419fcb293edfd51

    • SHA1

      4c06fd1436794ccb4852cd086bc21c54c5ec53b0

    • SHA256

      637c5a6da12669b77450722407c7b63a057e10b5b4f43e6b2ae5a833e9b721e4

    • SHA512

      d856d260bc9a041674fc1b041204b53b8f48d30b56ed7450a6a1a0d6a07352a002192d60ce42a08f506f57fab6390f000974f36133ae4d323e436e6b92f132bd

    Score
    10/10
    njrathackedevasionpersistencespywarestealertrojanupx

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Loads dropped DLL

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Uses the VBS compiler for execution

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks