Overview

overview

10

Static

static

10

086d0beffb...cc.exe

windows7_x64

10

086d0beffb...cc.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    086d0beffb9ac2f9e7c502496dfffacc.exe

  • Size

    37KB

  • Sample

    220407-leq95secc2

  • MD5

    086d0beffb9ac2f9e7c502496dfffacc

  • SHA1

    8ab427c8509c644b276db5edca504bd739eb135e

  • SHA256

    266dc410718f70b5c26f84779f65f09d0d6d73cc8404285dd4e0d48a90959c5e

  • SHA512

    be8ad234c1aab5619107bb27b8f6905629b435062e56189472f602d51363c16a65ca6be5bbc0282ccac6044be4e4c377eae393f1ff823d4d2bb3cbb11639c9b2

Score
10/10
njrathackevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

hack

C2

6.tcp.ngrok.io:13420

Mutex

2bafb35469254e19405da7b6b658f17c

Attributes
  • reg_key

    2bafb35469254e19405da7b6b658f17c

  • splitter

    |'|'|

Targets

    • Target

      086d0beffb9ac2f9e7c502496dfffacc.exe

    • Size

      37KB

    • MD5

      086d0beffb9ac2f9e7c502496dfffacc

    • SHA1

      8ab427c8509c644b276db5edca504bd739eb135e

    • SHA256

      266dc410718f70b5c26f84779f65f09d0d6d73cc8404285dd4e0d48a90959c5e

    • SHA512

      be8ad234c1aab5619107bb27b8f6905629b435062e56189472f602d51363c16a65ca6be5bbc0282ccac6044be4e4c377eae393f1ff823d4d2bb3cbb11639c9b2

    Score
    10/10
    njrathackevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Tasks