Overview

overview

10

Static

static

10

34d7b1735c...ef.exe

windows7_x64

8

34d7b1735c...ef.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    34d7b1735cdfa0069c7e44b631fb8738c11b37b1364dc12947e59ce15ad088ef

  • Size

    31KB

  • Sample

    220520-2grxfsfcg4

  • MD5

    b911c0a6103d209a401fa3069afae4af

  • SHA1

    c2c6bc16a56bb67aa355c62cccc2ecb85c067564

  • SHA256

    34d7b1735cdfa0069c7e44b631fb8738c11b37b1364dc12947e59ce15ad088ef

  • SHA512

    8b2bd174a089d9a631dfb00144a0ff042bc9ca34e9b57bb0f78ee61404deb3ce00501c0afca13547adbf5ac698641b1d076ced25ff4d28a8f7f55d34c95cd8bd

Score
10/10
njratcrackh2wevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

CrackH2W

C2

89.169.9.166:7777

Mutex

d40c4328dc25e43e07013c7b1eb02f91

Attributes
  • reg_key

    d40c4328dc25e43e07013c7b1eb02f91

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target

      34d7b1735cdfa0069c7e44b631fb8738c11b37b1364dc12947e59ce15ad088ef

    • Size

      31KB

    • MD5

      b911c0a6103d209a401fa3069afae4af

    • SHA1

      c2c6bc16a56bb67aa355c62cccc2ecb85c067564

    • SHA256

      34d7b1735cdfa0069c7e44b631fb8738c11b37b1364dc12947e59ce15ad088ef

    • SHA512

      8b2bd174a089d9a631dfb00144a0ff042bc9ca34e9b57bb0f78ee61404deb3ce00501c0afca13547adbf5ac698641b1d076ced25ff4d28a8f7f55d34c95cd8bd

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks