Overview

overview

10

Static

static

10

2032f4f31c...66.exe

windows7_x64

10

2032f4f31c...66.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2032f4f31c54a376ba843d105bcc38e057ce52da9f2274d42c6391d308718366

  • Size

    220KB

  • Sample

    210903-k6rvbachc8

  • MD5

    036e2584148eb5111b7e78835dfb22b5

  • SHA1

    a434806f0660f1526600b166291a114496a93f66

  • SHA256

    2032f4f31c54a376ba843d105bcc38e057ce52da9f2274d42c6391d308718366

  • SHA512

    3fd80a96675000e558f05c04a9f60afc8409819d82ab3fb4022cc6e42c951c0b8f20fcd9ff1f75a99575117f538fdcad502424e34f9796d7c41de822bd01d5d8

Score
10/10
njrathelloevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

hello

C2

configpaid.hopto.org:1177

Mutex

2918d83a8048748f66be3a548e28d02b

Attributes
  • reg_key

    2918d83a8048748f66be3a548e28d02b

  • splitter

    |'|'|

Targets

    • Target

      2032f4f31c54a376ba843d105bcc38e057ce52da9f2274d42c6391d308718366

    • Size

      220KB

    • MD5

      036e2584148eb5111b7e78835dfb22b5

    • SHA1

      a434806f0660f1526600b166291a114496a93f66

    • SHA256

      2032f4f31c54a376ba843d105bcc38e057ce52da9f2274d42c6391d308718366

    • SHA512

      3fd80a96675000e558f05c04a9f60afc8409819d82ab3fb4022cc6e42c951c0b8f20fcd9ff1f75a99575117f538fdcad502424e34f9796d7c41de822bd01d5d8

    Score
    10/10
    njrathelloevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks