Overview

overview

10

Static

static

10

C68153CED4...68.exe

windows7_x64

10

C68153CED4...68.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    C68153CED490F150AAA321F8E017F5C04525BFC729F68.exe

  • Size

    23KB

  • Sample

    211121-1c2enaedgq

  • MD5

    6f583b03795a6bb7f086446ee6b11b62

  • SHA1

    5c7df1e74ee956641304e93ccd6766dd81277c07

  • SHA256

    c68153ced490f150aaa321f8e017f5c04525bfc729f68d8400fba21d0dfb1387

  • SHA512

    903a04fe11097e5f9bf3c81d37e16bdce0b5febf56b36704f26f827ad1ffd49975096078711fa433931bacf2a5f7fed13ddeab66c716953a1a139eee03723786

Score
10/10
njratxbuttonevasionpersistencesuricatatrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

xButtoN

C2

crlnegolamx.ddns.net:89

Mutex

3b51fad99c0c53b7f1590d6f74c8fccb

Attributes
  • reg_key

    3b51fad99c0c53b7f1590d6f74c8fccb

  • splitter

    |'|'|

Targets

    • Target

      C68153CED490F150AAA321F8E017F5C04525BFC729F68.exe

    • Size

      23KB

    • MD5

      6f583b03795a6bb7f086446ee6b11b62

    • SHA1

      5c7df1e74ee956641304e93ccd6766dd81277c07

    • SHA256

      c68153ced490f150aaa321f8e017f5c04525bfc729f68d8400fba21d0dfb1387

    • SHA512

      903a04fe11097e5f9bf3c81d37e16bdce0b5febf56b36704f26f827ad1ffd49975096078711fa433931bacf2a5f7fed13ddeab66c716953a1a139eee03723786

    Score
    10/10
    njratxbuttonevasionpersistencesuricatatrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata

    • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

      suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

      suricata

    • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)

      suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)

      suricata

    • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Get Passwords)

      suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Get Passwords)

      suricata

    • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)

      suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)

      suricata

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks