Overview

overview

10

Static

static

8

b02448be6d...1a.exe

windows7_x64

10

b02448be6d...1a.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b02448be6d957bc18ed6a1b97038ed1a.exe

  • Size

    353KB

  • Sample

    211028-1fx7eaccc2

  • MD5

    b02448be6d957bc18ed6a1b97038ed1a

  • SHA1

    33e8945ccc4f088a33977e75ec791ba6591880b4

  • SHA256

    11c0380a1944b579293ffb34e61b3dfdeaeebd712a5fcf1b2f377b50c5e49113

  • SHA512

    9fef4b91950c584e2390fa536084c01ea4f1ec9f397b26e2f98036425d261135c3d91b512e88d6328bcfd8ad1e0f42eabbf54f8b090af95ee1671b3bc9899a09

Score
10/10
njrathackedtrojanvmprotect

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

6.tcp.ngrok.io:19425

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      b02448be6d957bc18ed6a1b97038ed1a.exe

    • Size

      353KB

    • MD5

      b02448be6d957bc18ed6a1b97038ed1a

    • SHA1

      33e8945ccc4f088a33977e75ec791ba6591880b4

    • SHA256

      11c0380a1944b579293ffb34e61b3dfdeaeebd712a5fcf1b2f377b50c5e49113

    • SHA512

      9fef4b91950c584e2390fa536084c01ea4f1ec9f397b26e2f98036425d261135c3d91b512e88d6328bcfd8ad1e0f42eabbf54f8b090af95ee1671b3bc9899a09

    Score
    10/10
    njrathackedtrojanvmprotect

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks