Overview

overview

10

Static

static

6ee76407ef...36.exe

windows7_x64

10

6ee76407ef...36.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436

  • Size

    264KB

  • Sample

    220121-3vrdhseabm

  • MD5

    695c5d19dc3c3c5cc39182e09d9274e6

  • SHA1

    bc0aa3fce44b7d252919d820860709a0052cb76c

  • SHA256

    6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436

  • SHA512

    a20bf0b073c43f55f9a8797e093422b2aea58949fa23e625e20ce9786421c120253cd4f988aa3b2f877d9cc7f6c472e8daabe58489d7b7ea2bec5c339e855e4b

Score
10/10
njratzalupa180417evasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

zalupa180417

C2

808080.ddns.net:5555

Mutex

4cb72bb7475074f5af41f3e5e189ee3f

Attributes
  • reg_key

    4cb72bb7475074f5af41f3e5e189ee3f

  • splitter

    |'|'|

Targets

    • Target

      6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436

    • Size

      264KB

    • MD5

      695c5d19dc3c3c5cc39182e09d9274e6

    • SHA1

      bc0aa3fce44b7d252919d820860709a0052cb76c

    • SHA256

      6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436

    • SHA512

      a20bf0b073c43f55f9a8797e093422b2aea58949fa23e625e20ce9786421c120253cd4f988aa3b2f877d9cc7f6c472e8daabe58489d7b7ea2bec5c339e855e4b

    Score
    10/10
    njratzalupa180417evasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks