Overview

overview

10

Static

static

7H2B1N27_P...PT.vbs

windows7_x64

10

7H2B1N27_P...PT.vbs

windows10_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    7H2B1N27_PAYMENT_RECEIPT.vbs
  • Size 2KB
  • Sample220105-j9ll2aaba5
  • SHA256 7ad872e2d279268cc3107a90337b4beb3be0fc888668d60e6995d64b8955b2e6
  • MD5 SHA1 SHA512
Score
10/10
neshtanjrathackedevasionpersistencespywaretrojan

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • ps1.dropper

    https://transfer.sh/get/BKC469/HHHHHHHHHHHHHHHH.txt

Extracted

Family

  • njrat

Version

  • 1.9

Botnet

  • HacKed

Mutex

  • Microsoft.Exe

Attributes
  • reg_key

    Microsoft.Exe

Targets

    • Target
      7H2B1N27_PAYMENT_RECEIPT.vbs
    • Size 2KB
    • SHA256 7ad872e2d279268cc3107a90337b4beb3be0fc888668d60e6995d64b8955b2e6
    • MD5 SHA1 SHA512
    Score
    10/10
    neshtanjrathackedevasionpersistencespywaretrojan

    • Detect Neshta Payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Blocklisted process makes network request

    • Modifies Windows Firewall

      evasion

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks