Overview

overview

10

Static

static

10

tmp/bc61a6...er.exe

windows7_x64

10

tmp/bc61a6...er.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp/bc61a6f7-5775-425d-9200-2f3e41d4fc52_server.exe

  • Size

    23KB

  • Sample

    211216-wad45adcen

  • MD5

    f4777ed999fd8352227e750ac0e1b85d

  • SHA1

    fb8c3aa14e4a3bd678bb2ac5fb9d8eaa10f55cd3

  • SHA256

    608a0047a24db367a88e482bef92fd3b9a33db19ad3635b404132202e432eacc

  • SHA512

    4f1f20dce2375392339a3c1ef79ec7708b55b539c949b25655f3a1c749f9cdb875b2f5471c3642b586f6cf28e82caa357fd2d786819acdc6fe6cdef3cba06f80

Score
10/10
njrattaskmmaevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

TaskMMA

C2

musicnote.soundcast.me:95

Mutex

db0e5b24d38dbc2eff0e1a06df9e59b7

Attributes
  • reg_key

    db0e5b24d38dbc2eff0e1a06df9e59b7

  • splitter

    |'|'|

Targets

    • Target

      tmp/bc61a6f7-5775-425d-9200-2f3e41d4fc52_server.exe

    • Size

      23KB

    • MD5

      f4777ed999fd8352227e750ac0e1b85d

    • SHA1

      fb8c3aa14e4a3bd678bb2ac5fb9d8eaa10f55cd3

    • SHA256

      608a0047a24db367a88e482bef92fd3b9a33db19ad3635b404132202e432eacc

    • SHA512

      4f1f20dce2375392339a3c1ef79ec7708b55b539c949b25655f3a1c749f9cdb875b2f5471c3642b586f6cf28e82caa357fd2d786819acdc6fe6cdef3cba06f80

    Score
    10/10
    njratevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks