Overview

overview

10

Static

static

10

1c51743f17...5c.exe

windows7_x64

10

1c51743f17...5c.exe

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1c51743f17f9c5857d6ef3e2055d7e5c.exe

  • Size

    37KB

  • Sample

    220407-vcsvmaagd2

  • MD5

    1c51743f17f9c5857d6ef3e2055d7e5c

  • SHA1

    a7ff86648725f2113316fe43c3e090ecdddde833

  • SHA256

    e38f21ebea32604e4eb53752699175be72bff67e891a9bc5ba06538225554398

  • SHA512

    839246085d1e9ce3be6bf618e00812c223a0e7ad5d71d1debe7ce0a5e8653dfd66d0860f79382ec71edf97093e6e23a8e54313aad01ea6ed76b8a3fbacb33f22

Score
10/10
njrathackevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

hack

C2

6.tcp.ngrok.io:13420

Mutex

2bafb35469254e19405da7b6b658f17c

Attributes
  • reg_key

    2bafb35469254e19405da7b6b658f17c

  • splitter

    |'|'|

Targets

    • Target

      1c51743f17f9c5857d6ef3e2055d7e5c.exe

    • Size

      37KB

    • MD5

      1c51743f17f9c5857d6ef3e2055d7e5c

    • SHA1

      a7ff86648725f2113316fe43c3e090ecdddde833

    • SHA256

      e38f21ebea32604e4eb53752699175be72bff67e891a9bc5ba06538225554398

    • SHA512

      839246085d1e9ce3be6bf618e00812c223a0e7ad5d71d1debe7ce0a5e8653dfd66d0860f79382ec71edf97093e6e23a8e54313aad01ea6ed76b8a3fbacb33f22

    Score
    10/10
    njrathackevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Tasks