Overview

overview

10

Static

static

10

0df3ade3af...1f.exe

windows7_x64

10

0df3ade3af...1f.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f

  • Size

    4.8MB

  • Sample

    220525-cq6drsbgar

  • MD5

    b34ac778e2e106c5d747e6f33f01a863

  • SHA1

    c17521f2ddb2a538158ce7f9cc44ada2f61c40aa

  • SHA256

    0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f

  • SHA512

    cee1861805d3875073410722e728570b185d5701a16d6c32c7adc54d2ad6e633f08dbc709f71ea3fbc151eb824830d6fb2ff63d08a3ccf4f15b74dc26da05c0f

Score
10/10
njratsystemevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

System

C2

videobabshering.ru:3389

Mutex

b21bc800264adb97f1965cc7df1cb800

Attributes
  • reg_key

    b21bc800264adb97f1965cc7df1cb800

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target

      0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f

    • Size

      4.8MB

    • MD5

      b34ac778e2e106c5d747e6f33f01a863

    • SHA1

      c17521f2ddb2a538158ce7f9cc44ada2f61c40aa

    • SHA256

      0df3ade3af4c875ce8e834ad1c4e8052148173d8d95e757454279454a11c311f

    • SHA512

      cee1861805d3875073410722e728570b185d5701a16d6c32c7adc54d2ad6e633f08dbc709f71ea3fbc151eb824830d6fb2ff63d08a3ccf4f15b74dc26da05c0f

    Score
    10/10
    njratsystemevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks