Overview

overview

10

Static

static

9DE8E8B896...94.exe

windows7_x64

10

9DE8E8B896...94.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9DE8E8B8966F59A105A3D7D210075BC99535E9BA99694.exe

  • Size

    186KB

  • Sample

    210901-253sempydx

  • MD5

    7ab9be50e69390506c4ccc32fe58c4e5

  • SHA1

    af4972e56e140762ff2d2162d9ae8f3144fc34cf

  • SHA256

    9de8e8b8966f59a105a3d7d210075bc99535e9ba996946a4bb00f61118c49c92

  • SHA512

    e6227c29444bd26be42bd021b090199033ae5220785f507c1142a0476c9605717ad4958b8318cb6a6c64fe26ee46e54bd57968ddb6cf0e6a068a2a7c605bd252

Score
10/10
njratheheevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

hehe

C2

belabbes312.ddns.net:5552

Mutex

e6b3c2ef14cd98671cd277db95b39125

Attributes
  • reg_key

    e6b3c2ef14cd98671cd277db95b39125

  • splitter

    |'|'|

Targets

    • Target

      9DE8E8B8966F59A105A3D7D210075BC99535E9BA99694.exe

    • Size

      186KB

    • MD5

      7ab9be50e69390506c4ccc32fe58c4e5

    • SHA1

      af4972e56e140762ff2d2162d9ae8f3144fc34cf

    • SHA256

      9de8e8b8966f59a105a3d7d210075bc99535e9ba996946a4bb00f61118c49c92

    • SHA512

      e6227c29444bd26be42bd021b090199033ae5220785f507c1142a0476c9605717ad4958b8318cb6a6c64fe26ee46e54bd57968ddb6cf0e6a068a2a7c605bd252

    Score
    10/10
    njratheheevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks