Overview

overview

10

Static

static

10

tmp/8e31c8..._z.exe

windows7_x64

10

tmp/8e31c8..._z.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    tmp/8e31c82b-d24e-4913-ba99-28556fc235b7_z.exe

  • Size

    89KB

  • Sample

    211223-fm1kwshaa9

  • MD5

    bf23f92ee8ce0bfa063f5fc4dcce2e3b

  • SHA1

    b6d9a583a74c9bdaadb7b3049f9a2ba331c99195

  • SHA256

    25e00dc8e1093e41bfe3ee6db1c3171039f3ead9628825da82847dd28b3838bf

  • SHA512

    68b9ba60a3e91eb096f5c3680da2bc04204ca590b4292d4421fe1ed6069efb7d4c7391c5b2774d295c1a144ba09aeebd0891d82caa8912e7cb4a9cbeeb8b5c31

Score
10/10
njratpruebaevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

prueba

C2

111.90.149.115:9443

Mutex

f2defcfce1660e18fd445b5dbce27282

Attributes
  • reg_key

    f2defcfce1660e18fd445b5dbce27282

  • splitter

    |'|'|

Targets

    • Target

      tmp/8e31c82b-d24e-4913-ba99-28556fc235b7_z.exe

    • Size

      89KB

    • MD5

      bf23f92ee8ce0bfa063f5fc4dcce2e3b

    • SHA1

      b6d9a583a74c9bdaadb7b3049f9a2ba331c99195

    • SHA256

      25e00dc8e1093e41bfe3ee6db1c3171039f3ead9628825da82847dd28b3838bf

    • SHA512

      68b9ba60a3e91eb096f5c3680da2bc04204ca590b4292d4421fe1ed6069efb7d4c7391c5b2774d295c1a144ba09aeebd0891d82caa8912e7cb4a9cbeeb8b5c31

    Score
    10/10
    njratevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks