Overview

overview

10

Static

static

10

GeforceNow.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    GeforceNow.exe

  • Size

    29KB

  • Sample

    211220-ft7msaaeam

  • MD5

    f1aa4749c6bf4f095862c0a26c32eb26

  • SHA1

    99cfe703d358c76b06feccc397c4461e39e02309

  • SHA256

    e1a51853ecacc1cc2ecb286ee437e3ec340c78a398e88cab47eaa874ac7af7de

  • SHA512

    4e3ab6ba5a010f0e9162cfce693b199d161f5fcb33f5d51bb5948e8aebc281750e58b9d8e1a8cac04e7627afa2adbc584094a840e0e899c46032098d82ae99f2

Score
10/10
njratx33evasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

x33

C2

flubabapro.duckdns.org:53

Mutex

599ba46d0096edac8ad1cb1ef14e5829

Attributes
  • reg_key

    599ba46d0096edac8ad1cb1ef14e5829

  • splitter

    |'|'|

Targets

    • Target

      GeforceNow.exe

    • Size

      29KB

    • MD5

      f1aa4749c6bf4f095862c0a26c32eb26

    • SHA1

      99cfe703d358c76b06feccc397c4461e39e02309

    • SHA256

      e1a51853ecacc1cc2ecb286ee437e3ec340c78a398e88cab47eaa874ac7af7de

    • SHA512

      4e3ab6ba5a010f0e9162cfce693b199d161f5fcb33f5d51bb5948e8aebc281750e58b9d8e1a8cac04e7627afa2adbc584094a840e0e899c46032098d82ae99f2

    Score
    10/10
    njratx33evasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks