Overview

overview

10

Static

static

697a03588c...ef.exe

windows7_x64

10

697a03588c...ef.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    697a03588c4aa24e8b85ce0c55277d9ae65bf1b455125ecef64a83a3920449ef

  • Size

    23KB

  • Sample

    210228-35ltbrmthe

  • MD5

    01d11cfd0296189005cd28010bea8997

  • SHA1

    0b7eaab6ca85b0aea9ac059041ea3288221862d8

  • SHA256

    697a03588c4aa24e8b85ce0c55277d9ae65bf1b455125ecef64a83a3920449ef

  • SHA512

    a5b2676a60ae68e1f3729f4af092ac41e4f3edc288e53172f66a4b669f451619130978028c14436cd86d218ef46c79c4317d3b9cf873817d6b659778ddd42a3c

Score
10/10
njratwirelesskeyevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

WirelessKey

C2

552020.ddns.net:5552

Mutex

52848614b130542748d8bc2310e8563e

Attributes
  • reg_key

    52848614b130542748d8bc2310e8563e

  • splitter

    |'|'|

Targets

    • Target

      697a03588c4aa24e8b85ce0c55277d9ae65bf1b455125ecef64a83a3920449ef

    • Size

      23KB

    • MD5

      01d11cfd0296189005cd28010bea8997

    • SHA1

      0b7eaab6ca85b0aea9ac059041ea3288221862d8

    • SHA256

      697a03588c4aa24e8b85ce0c55277d9ae65bf1b455125ecef64a83a3920449ef

    • SHA512

      a5b2676a60ae68e1f3729f4af092ac41e4f3edc288e53172f66a4b669f451619130978028c14436cd86d218ef46c79c4317d3b9cf873817d6b659778ddd42a3c

    Score
    10/10
    njratwirelesskeyevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks