Overview

overview

10

Static

static

9047cdc0d2...ac.exe

windows7_x64

10

9047cdc0d2...ac.exe

windows10-2004_x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9047cdc0d2b4545510afd790a22a2b8ae80ffd93417fc9298c45ce19c9e6afac

  • Size

    219KB

  • Sample

    220508-jfld6secan

  • MD5

    d4b767364b44696a5f507c46359ba400

  • SHA1

    94dafff404e1f36749a885de5614d7ef3741763d

  • SHA256

    9047cdc0d2b4545510afd790a22a2b8ae80ffd93417fc9298c45ce19c9e6afac

  • SHA512

    1fa0c8818a0c7cf00526a60e2705312f4bd31c73a9dc3e2993d051bc2f78a2f58db28ae0be017fac9c38bf620181fc97f4647fac2a9f97a4e163d16c9e07d1b4

Score
10/10
njratsystempersistencetrojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

system

C2

bozuksaatiniz.duckdns.org:1604

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      9047cdc0d2b4545510afd790a22a2b8ae80ffd93417fc9298c45ce19c9e6afac

    • Size

      219KB

    • MD5

      d4b767364b44696a5f507c46359ba400

    • SHA1

      94dafff404e1f36749a885de5614d7ef3741763d

    • SHA256

      9047cdc0d2b4545510afd790a22a2b8ae80ffd93417fc9298c45ce19c9e6afac

    • SHA512

      1fa0c8818a0c7cf00526a60e2705312f4bd31c73a9dc3e2993d051bc2f78a2f58db28ae0be017fac9c38bf620181fc97f4647fac2a9f97a4e163d16c9e07d1b4

    Score
    10/10
    njratsystempersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks