Overview

overview

10

Static

static

b57e79ab29...e0.exe

windows7_x64

10

b57e79ab29...e0.exe

windows10-2004_x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    b57e79ab29ef870fe17d27375e65bce0.exe
  • Size 488KB
  • Sample220405-e6hzhshcg3
  • SHA256 bff236cb3c2cbc2e5c9feaa5bdd967fd07b9047cbb73b70b63e07c334049d8a3
  • MD5 SHA1 SHA512
Score
10/10
njratfilmzzzzevasiontrojan

Malware Config

Extracted

Family

  • njrat

Version

  • 0.7.3

Botnet

  • filmzzzz

C2

  • film.royalprop.trade:8109

Mutex

  • Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    0987

Targets

    • Target
      b57e79ab29ef870fe17d27375e65bce0.exe
    • Size 488KB
    • SHA256 bff236cb3c2cbc2e5c9feaa5bdd967fd07b9047cbb73b70b63e07c334049d8a3
    • MD5 SHA1 SHA512
    Score
    10/10
    njratfilmzzzzevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Looks for VMWare Tools registry key

      evasion

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks