Overview

overview

10

Static

static

3834a5a4cb...3d.exe

windows7_x64

10

3834a5a4cb...3d.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3834a5a4cbe48252ed7019596b4dd910c5c3d30b527b94c34798dbe8db95ee3d

  • Size

    3.8MB

  • Sample

    220625-zlxbmabegp

  • MD5

    4252f2ca6c16c3406294894a496714bb

  • SHA1

    549d7f01ab15ba44b77bcb4601929b19efe21619

  • SHA256

    3834a5a4cbe48252ed7019596b4dd910c5c3d30b527b94c34798dbe8db95ee3d

  • SHA512

    8db3820e025871a8e410ab5ccde92526fc31c1095e06757e9efd697aa0289e4199a9384b4006fe5f4026a02222a34c43cb893e3e030ab1e6cdf757f1a9c4760d

Score
10/10
njratsentryevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Sentry

C2

connertyler58.ddns.net:5537

Mutex

bee015c03df24a72bb52e5f747515b7e

Attributes
  • reg_key

    bee015c03df24a72bb52e5f747515b7e

  • splitter

    |'|'|

Targets

    • Target

      3834a5a4cbe48252ed7019596b4dd910c5c3d30b527b94c34798dbe8db95ee3d

    • Size

      3.8MB

    • MD5

      4252f2ca6c16c3406294894a496714bb

    • SHA1

      549d7f01ab15ba44b77bcb4601929b19efe21619

    • SHA256

      3834a5a4cbe48252ed7019596b4dd910c5c3d30b527b94c34798dbe8db95ee3d

    • SHA512

      8db3820e025871a8e410ab5ccde92526fc31c1095e06757e9efd697aa0289e4199a9384b4006fe5f4026a02222a34c43cb893e3e030ab1e6cdf757f1a9c4760d

    Score
    10/10
    njratsentryevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks