Overview

overview

10

Static

static

4e164a36f9...38.exe

windows7_x64

10

4e164a36f9...38.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4e164a36f967b7eb35889c956ce745dcdc057c10399fe76140449fe38abafe38

  • Size

    328KB

  • Sample

    220308-w3p24aadb6

  • MD5

    e0d0ff8d8fe7f1f62368d24e9f3f49cd

  • SHA1

    7a65c94b58fb5cbfdd9b377beb9f4e965646963a

  • SHA256

    4e164a36f967b7eb35889c956ce745dcdc057c10399fe76140449fe38abafe38

  • SHA512

    7f9d94909bd8cfd1f98d87c70514719c9c35e49e7f8d6a55e1c7427bf50908e34496201d0402966b5bd0660ef78382b9f24e1528fe0c353804bc4d085aee7646

Score
10/10
njratv1persistencetrojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

v1

C2

xyz.videomarket.eu:1970

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      4e164a36f967b7eb35889c956ce745dcdc057c10399fe76140449fe38abafe38

    • Size

      328KB

    • MD5

      e0d0ff8d8fe7f1f62368d24e9f3f49cd

    • SHA1

      7a65c94b58fb5cbfdd9b377beb9f4e965646963a

    • SHA256

      4e164a36f967b7eb35889c956ce745dcdc057c10399fe76140449fe38abafe38

    • SHA512

      7f9d94909bd8cfd1f98d87c70514719c9c35e49e7f8d6a55e1c7427bf50908e34496201d0402966b5bd0660ef78382b9f24e1528fe0c353804bc4d085aee7646

    Score
    10/10
    njratv1persistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks