Overview

overview

10

Static

static

10

025cd14427...84.exe

windows7_x64

10

025cd14427...84.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    025cd1442738e1a4a5bb65425edba45995e04c83c8db2dcced4cd281e5603f84

  • Size

    37KB

  • Sample

    220520-fbl85adbhr

  • MD5

    9c209b8ade631d6b114e5e2232d446db

  • SHA1

    e507ae3d0791c5f93b5c36310dedae1b5668b9fa

  • SHA256

    025cd1442738e1a4a5bb65425edba45995e04c83c8db2dcced4cd281e5603f84

  • SHA512

    ca44cc7efe3ff8773241435b25ca3cc4fb42551351fd4730e0f7a02b98ea590a0fc771d3b866e5c00aaae139e95fbc831e700f712316a232543df73917a90a15

Score
10/10
njrathackedevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

77.111.244.4:5552

Mutex

fba08971911135145e79dfe7473d0205

Attributes
  • reg_key

    fba08971911135145e79dfe7473d0205

  • splitter

    |'|'|

Targets

    • Target

      025cd1442738e1a4a5bb65425edba45995e04c83c8db2dcced4cd281e5603f84

    • Size

      37KB

    • MD5

      9c209b8ade631d6b114e5e2232d446db

    • SHA1

      e507ae3d0791c5f93b5c36310dedae1b5668b9fa

    • SHA256

      025cd1442738e1a4a5bb65425edba45995e04c83c8db2dcced4cd281e5603f84

    • SHA512

      ca44cc7efe3ff8773241435b25ca3cc4fb42551351fd4730e0f7a02b98ea590a0fc771d3b866e5c00aaae139e95fbc831e700f712316a232543df73917a90a15

    Score
    10/10
    njrathackedevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks