Overview

overview

10

Static

static

10

a601df2c73...65.exe

windows7_x64

10

a601df2c73...65.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a601df2c73f63a84778303a96d681665.exe

  • Size

    43KB

  • Sample

    211108-qx8z5ahcfq

  • MD5

    a601df2c73f63a84778303a96d681665

  • SHA1

    e24836a3c8a577bf981df3adc0b66fdea713562f

  • SHA256

    64f9f7907d9d7c486cbad8d452c75cfed218ec8b8a1dccf97764a284085919a0

  • SHA512

    9c08357ecff7846b4fb526df932fe4e65b9af2f567baf0c64480ca9c94ba3812a3a4d19d76a4721b8c9ca0f3cd07e71d6aca3f414096077a08f79ada161f6f7b

Score
10/10
njrathackedpersistencesuricatatrojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

6.tcp.ngrok.io:10332

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      a601df2c73f63a84778303a96d681665.exe

    • Size

      43KB

    • MD5

      a601df2c73f63a84778303a96d681665

    • SHA1

      e24836a3c8a577bf981df3adc0b66fdea713562f

    • SHA256

      64f9f7907d9d7c486cbad8d452c75cfed218ec8b8a1dccf97764a284085919a0

    • SHA512

      9c08357ecff7846b4fb526df932fe4e65b9af2f567baf0c64480ca9c94ba3812a3a4d19d76a4721b8c9ca0f3cd07e71d6aca3f414096077a08f79ada161f6f7b

    Score
    10/10
    njrathackedpersistencesuricatatrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks