Overview

overview

10

Static

static

d173b9844b...bd.exe

windows7_x64

1

d173b9844b...bd.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exe

  • Size

    4KB

  • Sample

    211105-pths4aghel

  • MD5

    b9a1c7dd8171afe0e3fc1524f5eafb18

  • SHA1

    19b79357841b2bcb3438011f4c8e45f7278aeaa9

  • SHA256

    d173b9844be24a9172f2f2adcde3dd65090afa690b1bd952a7da01de33ad60ef

  • SHA512

    d57c9cf4a489dec1f8b17351173e1ffc202e454f214b85e132fbd5d8af2d4a611e50e1a7f85eb0dfce438539aaec3b143d1fafafbaa0def914f6401c5993da6d

Score
10/10
njratnyan catpersistencesuricatatrojan

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

redlan.linkpc.net:5553

Mutex

3b407dd04ed042

Attributes
  • reg_key

    3b407dd04ed042

  • splitter

    @!#&^%$

Targets

    • Target

      d173b9844be24a9172f2f2adcde3dd65090afa690b1bd.exe

    • Size

      4KB

    • MD5

      b9a1c7dd8171afe0e3fc1524f5eafb18

    • SHA1

      19b79357841b2bcb3438011f4c8e45f7278aeaa9

    • SHA256

      d173b9844be24a9172f2f2adcde3dd65090afa690b1bd952a7da01de33ad60ef

    • SHA512

      d57c9cf4a489dec1f8b17351173e1ffc202e454f214b85e132fbd5d8af2d4a611e50e1a7f85eb0dfce438539aaec3b143d1fafafbaa0def914f6401c5993da6d

    Score
    10/10
    njratnyan catpersistencesuricatatrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata

    • Blocklisted process makes network request

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks