Overview

overview

10

Static

static

3fea429388...88.exe

windows7_x64

10

3fea429388...88.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3fea4293884a17a3f087ad02edb9cf23762085bd39b189b5875bf3f00f3cd688

  • Size

    56KB

  • Sample

    220329-xfpcqahha7

  • MD5

    a18ec598943bf1d2385feb79528082e8

  • SHA1

    39069a6598657ae0dc9ede722cecd629a8c9d315

  • SHA256

    3fea4293884a17a3f087ad02edb9cf23762085bd39b189b5875bf3f00f3cd688

  • SHA512

    dd1e9c0562a56c58b39501bb07c66450692ad0387fb4b8b580c74371dc83bc5ed7815c6cb7fc72200ade593b724a4eef9ede4be0d7be0fad40db8736c1bf8ecd

Score
10/10
njratzombieevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Botnet

Zombie

Mutex

2b0b46ffac65ee5caab788b335debf15

Attributes
  • reg_key

    2b0b46ffac65ee5caab788b335debf15

Targets

    • Target

      3fea4293884a17a3f087ad02edb9cf23762085bd39b189b5875bf3f00f3cd688

    • Size

      56KB

    • MD5

      a18ec598943bf1d2385feb79528082e8

    • SHA1

      39069a6598657ae0dc9ede722cecd629a8c9d315

    • SHA256

      3fea4293884a17a3f087ad02edb9cf23762085bd39b189b5875bf3f00f3cd688

    • SHA512

      dd1e9c0562a56c58b39501bb07c66450692ad0387fb4b8b580c74371dc83bc5ed7815c6cb7fc72200ade593b724a4eef9ede4be0d7be0fad40db8736c1bf8ecd

    Score
    10/10
    njratzombieevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks