Overview

overview

10

Static

static

10

af75bf198f...36.exe

windows7_x64

10

af75bf198f...36.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    af75bf198fdc4a21ce1758f5843b1036.exe

  • Size

    37KB

  • Sample

    220122-sx2l6abha5

  • MD5

    af75bf198fdc4a21ce1758f5843b1036

  • SHA1

    673eb926d11c448cc2a2af4907544068e6c28e25

  • SHA256

    50b8b19e4501f07b8bb5cff4640776abddc175a8bf352eebdfef908c2b456e30

  • SHA512

    abc31ae1f77ade27a35d773b3d527af73bd9f6bff7f55bbd878e364d872495313b31956133bb1ac8e6af6021ba9d91f39a8de09991b09e056fdf47489b31a001

Score
10/10
njrathackedevasiontrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

4.tcp.ngrok.io:14567

Mutex

2d398c18ec3965eac95679b5b376b4ab

Attributes
  • reg_key

    2d398c18ec3965eac95679b5b376b4ab

  • splitter

    |'|'|

Targets

    • Target

      af75bf198fdc4a21ce1758f5843b1036.exe

    • Size

      37KB

    • MD5

      af75bf198fdc4a21ce1758f5843b1036

    • SHA1

      673eb926d11c448cc2a2af4907544068e6c28e25

    • SHA256

      50b8b19e4501f07b8bb5cff4640776abddc175a8bf352eebdfef908c2b456e30

    • SHA512

      abc31ae1f77ade27a35d773b3d527af73bd9f6bff7f55bbd878e364d872495313b31956133bb1ac8e6af6021ba9d91f39a8de09991b09e056fdf47489b31a001

    Score
    10/10
    njrathackedevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks