Overview

overview

10

Static

static

098228c41a...c8.exe

windows7_x64

10

098228c41a...c8.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    098228c41a3a687a644f54adb173337776854baef18398bb10acd79cd5c557c8

  • Size

    3.0MB

  • Sample

    220222-1frdvsfdam

  • MD5

    7dfe40654aabe873de1ce8c96e43bb23

  • SHA1

    49fc0259f3fe7b3a323cbf7c0e35e648b26fdd40

  • SHA256

    098228c41a3a687a644f54adb173337776854baef18398bb10acd79cd5c557c8

  • SHA512

    62d78d1fd2967ab80d57f0cd5eb886ec01380ca9b640f3f0ccde7acd1a2a5d99e7e33eace114930cb0173d34bde6f4afd6a09e32a6cbf84860f62815ebf0d7fa

Score
10/10
njrathackerevasionpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Hacker

C2

topgamer.duckdns.org:1177

Mutex

4105d230e42c61d705eedcc9d12118e9

Attributes
  • reg_key

    4105d230e42c61d705eedcc9d12118e9

  • splitter

    |'|'|

Targets

    • Target

      098228c41a3a687a644f54adb173337776854baef18398bb10acd79cd5c557c8

    • Size

      3.0MB

    • MD5

      7dfe40654aabe873de1ce8c96e43bb23

    • SHA1

      49fc0259f3fe7b3a323cbf7c0e35e648b26fdd40

    • SHA256

      098228c41a3a687a644f54adb173337776854baef18398bb10acd79cd5c557c8

    • SHA512

      62d78d1fd2967ab80d57f0cd5eb886ec01380ca9b640f3f0ccde7acd1a2a5d99e7e33eace114930cb0173d34bde6f4afd6a09e32a6cbf84860f62815ebf0d7fa

    Score
    10/10
    njrathackerevasionpersistencespywarestealertrojanupx

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Modifies security service

      evasion

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • NirSoft WebBrowserPassView

      Password recovery tool for various web browsers

    • Nirsoft

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

3
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

4
T1112

Disabling Security Tools

1
T1089

Install Root Certificate

1
T1130

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks