Overview

overview

10

Static

static

10

2c99e49bee...00.exe

windows7_x64

10

2c99e49bee...00.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2c99e49bee02b3833e3261074d7bea04f693b96d3598a1792a0e40640bd61300

  • Size

    37KB

  • Sample

    220520-2vj4rsgaf6

  • MD5

    a85447229532856b5447ddcadf0d99b9

  • SHA1

    c24b5c23db289cdddbcde67111b1264928a1be2c

  • SHA256

    2c99e49bee02b3833e3261074d7bea04f693b96d3598a1792a0e40640bd61300

  • SHA512

    824b3dcf0e76dd77d0b76602a98d227275861e5505b5bac6d4128d43209d424d87ad484b1058b14dc9fb0d657c0f74190c0ae60e544188e38e58a394308e652d

Score
10/10
njrathackedevasiontrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

svalkabomja333.hopto.org:1978

Mutex

ebdf784e4c631a8b558a06107e351925

Attributes
  • reg_key

    ebdf784e4c631a8b558a06107e351925

  • splitter

    |'|'|

Targets

    • Target

      2c99e49bee02b3833e3261074d7bea04f693b96d3598a1792a0e40640bd61300

    • Size

      37KB

    • MD5

      a85447229532856b5447ddcadf0d99b9

    • SHA1

      c24b5c23db289cdddbcde67111b1264928a1be2c

    • SHA256

      2c99e49bee02b3833e3261074d7bea04f693b96d3598a1792a0e40640bd61300

    • SHA512

      824b3dcf0e76dd77d0b76602a98d227275861e5505b5bac6d4128d43209d424d87ad484b1058b14dc9fb0d657c0f74190c0ae60e544188e38e58a394308e652d

    Score
    10/10
    njrathackedevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks