Overview

overview

10

Static

static

e2ee9010ff...8c.exe

windows7_x64

10

e2ee9010ff...8c.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e2ee9010ffc04e93475c14d0eec88610258cca058c25a6409914341b59c0b68c

  • Size

    341KB

  • Sample

    210929-jqedlsebd7

  • MD5

    e8fb8e14c5e50dd51a7499b84e2c857a

  • SHA1

    bad853c5496bc28f492c01cdc6fff77efd72dc74

  • SHA256

    e2ee9010ffc04e93475c14d0eec88610258cca058c25a6409914341b59c0b68c

  • SHA512

    2b15a3c3cb4b04f978043d45ac32ed2ab7dfef11ec0b6010a73a2d39b8aa112b18846cb60383c63108fd7bcd4c7f9abae26b354320902a59f923d436d73f4131

Score
10/10
njratcvcvcevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

cvcvc

C2

127.0.0.1:6544

Mutex

f08ba698cf12b161ed2e70452386d723

Attributes
  • reg_key

    f08ba698cf12b161ed2e70452386d723

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target

      e2ee9010ffc04e93475c14d0eec88610258cca058c25a6409914341b59c0b68c

    • Size

      341KB

    • MD5

      e8fb8e14c5e50dd51a7499b84e2c857a

    • SHA1

      bad853c5496bc28f492c01cdc6fff77efd72dc74

    • SHA256

      e2ee9010ffc04e93475c14d0eec88610258cca058c25a6409914341b59c0b68c

    • SHA512

      2b15a3c3cb4b04f978043d45ac32ed2ab7dfef11ec0b6010a73a2d39b8aa112b18846cb60383c63108fd7bcd4c7f9abae26b354320902a59f923d436d73f4131

    Score
    10/10
    njratcvcvcevasiontrojan

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Nirsoft

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Stops running service(s)

      evasion

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

4
T1031

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Disabling Security Tools

1
T1089

Impair Defenses

1
T1562

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Service Stop

1
T1489

Tasks