Overview

overview

10

Static

static

10

bf65c8e229...56.exe

windows7_x64

10

bf65c8e229...56.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bf65c8e2290aee1cd322f28edf25e804f9626636f0a3263281f172383b97b656

  • Size

    93KB

  • Sample

    220520-3gp9asbgfq

  • MD5

    74561ab8272480ac06696738092ce507

  • SHA1

    5182c427adf49862dcb6d2444df487c9f1bb21da

  • SHA256

    bf65c8e2290aee1cd322f28edf25e804f9626636f0a3263281f172383b97b656

  • SHA512

    07a710a0be9869f2759bf3bcd25a0d981f9503604dd0629cad43114da0942de6fc16da34330e41d7f1c88d43565c70b66c5c4095908392b370abe266b5be7c62

Score
10/10
njrathackedevasionsuricatatrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

FRANSESCOC50Y3Aubmdyb2suaW8Strik:MTM1Nzg=

Mutex

73137daa68006467b187b2f414df684d

Attributes
  • reg_key

    73137daa68006467b187b2f414df684d

  • splitter

    |'|'|

Targets

    • Target

      bf65c8e2290aee1cd322f28edf25e804f9626636f0a3263281f172383b97b656

    • Size

      93KB

    • MD5

      74561ab8272480ac06696738092ce507

    • SHA1

      5182c427adf49862dcb6d2444df487c9f1bb21da

    • SHA256

      bf65c8e2290aee1cd322f28edf25e804f9626636f0a3263281f172383b97b656

    • SHA512

      07a710a0be9869f2759bf3bcd25a0d981f9503604dd0629cad43114da0942de6fc16da34330e41d7f1c88d43565c70b66c5c4095908392b370abe266b5be7c62

    Score
    10/10
    njrathackedevasionsuricatatrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks