Overview

overview

10

Static

static

Invoice #33190.vbs

windows7_x64

10

Invoice #33190.vbs

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Invoice #33190.vbs
  • Size 733B
  • Sample210828-v74mrh6bvj
  • SHA256 d424a08c1e1eac484c029a6ef4008bf991aebf26a86aa02fecd18ad60bb24a0f
  • MD5 SHA1 SHA512
Score
10/10
njratsolopersistencetrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    http://transfer.sh/get/1jmaVDV/model.txt

Extracted

Family

  • njrat

Version

  • v2.0

Botnet

  • SOLO

C2

  • hydrometal.duckdns.org:5107

Mutex

  • Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Targets

    • Target
      Invoice #33190.vbs
    • Size 733B
    • SHA256 d424a08c1e1eac484c029a6ef4008bf991aebf26a86aa02fecd18ad60bb24a0f
    • MD5 SHA1 SHA512
    Score
    10/10
    njratsolopersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks