Overview

overview

10

Static

static

5

063b954426...7d.exe

windows7_x64

10

063b954426...7d.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d

  • Size

    1009KB

  • Sample

    210830-4snfxcbjbx

  • MD5

    3b7e67075780219f65693e397fa721b8

  • SHA1

    6cff74dcac65d345f10565268c95003854062f4a

  • SHA256

    063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d

  • SHA512

    cc5de66f5bab3054068de6e34ca2dff86ee9312036dd3b0d5f370f9821dfefc1c24d15e233000abfbf5da296726b43e14c4845a62428176636aab8bbf1d3f770

Score
10/10
njratlimebot3trojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Limebot3

C2

microsoftdnsbug.duckdns.org:6699

Mutex

Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    luffy

Targets

    • Target

      063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d

    • Size

      1009KB

    • MD5

      3b7e67075780219f65693e397fa721b8

    • SHA1

      6cff74dcac65d345f10565268c95003854062f4a

    • SHA256

      063b9544262ae25393961c4f57a4e4c5a73032644d2a22ff423b8a53bc6c6a7d

    • SHA512

      cc5de66f5bab3054068de6e34ca2dff86ee9312036dd3b0d5f370f9821dfefc1c24d15e233000abfbf5da296726b43e14c4845a62428176636aab8bbf1d3f770

    Score
    10/10
    njratlimebot3trojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    • autoit_exe

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks