Overview

overview

10

Static

static

Documentacion.PDF.vbs

windows7_x64

10

Documentacion.PDF.vbs

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Documentacion.PDF.vbs

  • Size

    162KB

  • Sample

    210915-p9y51safg3

  • MD5

    16dd6afc5e63f4edc4f35fd1176e63bd

  • SHA1

    d64a9461b703119695e76f880832924d487a648a

  • SHA256

    c34173dfa5a1a842bb14ef1fddd8f15b0998577740469b6987d138e165786994

  • SHA512

    3e2abe804b90ec51e1a7fb4145a0b11304e3d279c13cc3f65380721c079fb1b9711bb491e92b5e95c6ca957aeb7bfed9b33b030c094a1dcc3d4ebcab577b8df3

Score
10/10
njratnyan cattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

https://onedrive.live.com/download?cid=4DBCDBEA8A120146&resid=4DBCDBEA8A120146%21152&authkey=AP1AB-SxiNqVg04

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

pedrobedoya2021.duckdns.org:1980

Mutex

cf13c225ff474d45b

Attributes
  • reg_key

    cf13c225ff474d45b

  • splitter

    @!#&^%$

Targets

    • Target

      Documentacion.PDF.vbs

    • Size

      162KB

    • MD5

      16dd6afc5e63f4edc4f35fd1176e63bd

    • SHA1

      d64a9461b703119695e76f880832924d487a648a

    • SHA256

      c34173dfa5a1a842bb14ef1fddd8f15b0998577740469b6987d138e165786994

    • SHA512

      3e2abe804b90ec51e1a7fb4145a0b11304e3d279c13cc3f65380721c079fb1b9711bb491e92b5e95c6ca957aeb7bfed9b33b030c094a1dcc3d4ebcab577b8df3

    Score
    10/10
    njratnyan cattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks