Overview

overview

10

Static

static

Invoice#52190.vbs

windows7_x64

10

Invoice#52190.vbs

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Invoice#52190.vbs
  • Size 3KB
  • Sample210902-2wn593jf3n
  • SHA256 3441e66bd2febee7b35a6268f466b526628cdc2de0abab93b5cbf8a4c239d50a
  • MD5 SHA1 SHA512
Score
10/10
njratbosssuricatatrojan

Malware Config

Extracted

Family

  • njrat

Version

  • v4.0

Botnet

  • Boss

C2

  • 103.147.184.73:7103

Mutex

  • Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Targets

    • Target
      Invoice#52190.vbs
    • Size 3KB
    • SHA256 3441e66bd2febee7b35a6268f466b526628cdc2de0abab93b5cbf8a4c239d50a
    • MD5 SHA1 SHA512
    Score
    10/10
    njratbosssuricatatrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata

    • Blocklisted process makes network request

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks