Overview

overview

10

Static

static

Q4EtLThkYlEkFvu.exe

windows7_x64

10

Q4EtLThkYlEkFvu.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Q4EtLThkYlEkFvu.exe

  • Size

    474KB

  • Sample

    211102-qcv8jaceg9

  • MD5

    18156edcb0549e6e856811b5a57b951d

  • SHA1

    c9c773a0157562c8fa800aad23c670486fd63fbd

  • SHA256

    8c6ca1c8128480b39bed5d584b13880534bc0155cf05df5ab5ebd1dc63f53207

  • SHA512

    c881d069a6403a22b02ee71dd062fdb6718f23c6c1de859d142dcd9e4c642555c3c5f72bc6b0aa1bab3ff6539a7c59e3415bca0b8f636cfcc5b9dbd5afb39775

Score
10/10
njratorder1persistencetrojan

Malware Config

Extracted

Family

njrat

Version

v4.0

Botnet

order1

C2

45.137.22.146:5553

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Targets

    • Target

      Q4EtLThkYlEkFvu.exe

    • Size

      474KB

    • MD5

      18156edcb0549e6e856811b5a57b951d

    • SHA1

      c9c773a0157562c8fa800aad23c670486fd63fbd

    • SHA256

      8c6ca1c8128480b39bed5d584b13880534bc0155cf05df5ab5ebd1dc63f53207

    • SHA512

      c881d069a6403a22b02ee71dd062fdb6718f23c6c1de859d142dcd9e4c642555c3c5f72bc6b0aa1bab3ff6539a7c59e3415bca0b8f636cfcc5b9dbd5afb39775

    Score
    10/10
    njratorder1persistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Hidden Files and Directories

1
T1158

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks