Overview

overview

10

Static

static

10

fbb4863016...99.exe

windows7_x64

10

fbb4863016...99.exe

windows10-2004_x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fbb4863016dfcfc7f11e3d41896c2f42efd1c376d5c85f7b9bcd0d244e260b99

  • Size

    32KB

  • Sample

    220201-p2zrkshdf8

  • MD5

    08636ca8d5d28006ddf067c6d251613b

  • SHA1

    cde8d41c71fda0d09ab8653231b4c9edb9e0afed

  • SHA256

    fbb4863016dfcfc7f11e3d41896c2f42efd1c376d5c85f7b9bcd0d244e260b99

  • SHA512

    c95076961ff333e17c62955089bc23166a54e05726f4e568dd917a6de02dda29533488538169abb6b33de1e242582e0440b7186aa7070e4386424e11d9701b9c

Score
10/10
njratrobyevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Botnet

roby

Mutex

4bda69d82f2ad26800386604df9bc3de

Attributes
  • reg_key

    4bda69d82f2ad26800386604df9bc3de

Targets

    • Target

      fbb4863016dfcfc7f11e3d41896c2f42efd1c376d5c85f7b9bcd0d244e260b99

    • Size

      32KB

    • MD5

      08636ca8d5d28006ddf067c6d251613b

    • SHA1

      cde8d41c71fda0d09ab8653231b4c9edb9e0afed

    • SHA256

      fbb4863016dfcfc7f11e3d41896c2f42efd1c376d5c85f7b9bcd0d244e260b99

    • SHA512

      c95076961ff333e17c62955089bc23166a54e05726f4e568dd917a6de02dda29533488538169abb6b33de1e242582e0440b7186aa7070e4386424e11d9701b9c

    Score
    10/10
    njratrobyevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks