Overview

overview

10

Static

static

10

38342df262...ea.exe

windows7_x64

10

38342df262...ea.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    38342df2626757f3c57e8e676e43e6d13793c6a59223832d0870cb10042378ea

  • Size

    22KB

  • Sample

    220520-z9wp1adfd5

  • MD5

    21a3d134aa052a5b370dd77421710d7f

  • SHA1

    6d23921fd2b5ae703a2035c9024558b58319a505

  • SHA256

    38342df2626757f3c57e8e676e43e6d13793c6a59223832d0870cb10042378ea

  • SHA512

    a61c4bc538c9f649af39d563f1f9a6078d33c6ecc0261c54034faed65efa87b58bee3c828a0db14d7e813c2575a73e70959329df8e8290929bac5f31f511f449

Score
10/10
njrathackedevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

0c330b94331d116c171b620aff233393

Attributes
  • reg_key

    0c330b94331d116c171b620aff233393

  • splitter

    |'|'|

Targets

    • Target

      38342df2626757f3c57e8e676e43e6d13793c6a59223832d0870cb10042378ea

    • Size

      22KB

    • MD5

      21a3d134aa052a5b370dd77421710d7f

    • SHA1

      6d23921fd2b5ae703a2035c9024558b58319a505

    • SHA256

      38342df2626757f3c57e8e676e43e6d13793c6a59223832d0870cb10042378ea

    • SHA512

      a61c4bc538c9f649af39d563f1f9a6078d33c6ecc0261c54034faed65efa87b58bee3c828a0db14d7e813c2575a73e70959329df8e8290929bac5f31f511f449

    Score
    10/10
    njrathackedevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks