Overview

overview

10

Static

static

10

48CC6BD83E...67.exe

windows7_x64

10

48CC6BD83E...67.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    48CC6BD83E2933DF14DAFD0ED0E119215ED134FC57167.exe

  • Size

    3.7MB

  • Sample

    211109-d3m9dsbegq

  • MD5

    1856b06c2392d0a5e7b73f4e98e3a840

  • SHA1

    23a8cf21174428413fac5fe98b02035b9a8d6857

  • SHA256

    48cc6bd83e2933df14dafd0ed0e119215ed134fc57167b768c48202b54d4bb41

  • SHA512

    a7bab37f2b196263c9790854f84b71171e7fd9541a12d66f3d383c6f526b26dc0cb3df3376085b6d449c20f5338c4100da3efcfcd7d5192bd517a61a2f8f75a8

Score
10/10
njratdot@ kgpersistencesuricatatrojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

DoT@ kg

C2

2.tcp.ngrok.io:19365

Mutex

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update

Windows Update
Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      48CC6BD83E2933DF14DAFD0ED0E119215ED134FC57167.exe

    • Size

      3.7MB

    • MD5

      1856b06c2392d0a5e7b73f4e98e3a840

    • SHA1

      23a8cf21174428413fac5fe98b02035b9a8d6857

    • SHA256

      48cc6bd83e2933df14dafd0ed0e119215ed134fc57167b768c48202b54d4bb41

    • SHA512

      a7bab37f2b196263c9790854f84b71171e7fd9541a12d66f3d383c6f526b26dc0cb3df3376085b6d449c20f5338c4100da3efcfcd7d5192bd517a61a2f8f75a8

    Score
    10/10
    njratdot@ kgpersistencesuricatatrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata

    • Executes dropped EXE

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks