Overview

overview

10

Static

static

10

0x00070000...90.exe

windows7_x64

10

0x00070000...90.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0x00070000000133e8-90.dat

  • Size

    25KB

  • Sample

    220627-qr3k6adcd9

  • MD5

    13a393f4abc0575a0c3661a2058c6a92

  • SHA1

    c35e88355d846094a9b9aeaef3822725cd65c898

  • SHA256

    685deaa148f2ded23bfac7a5bced8399f438b6825c48fa3c4d302470d4c23ad4

  • SHA512

    f33ef8ac7264a64982873a9dc7defff8c161376c59844047cf117b64d35c1d46c708e6fa03e7b2f999233816892ea6bad62f09a81112247502cf611904709ba6

Score
10/10
njrathacked... w2bevasionpersistencesuricatatrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HACKED... W2B

C2

103.149.13.61:4545

Mutex

f33599fc8954f4bf201159e017f34658

Attributes
  • reg_key

    f33599fc8954f4bf201159e017f34658

  • splitter

    |'|'|

Targets

    • Target

      0x00070000000133e8-90.dat

    • Size

      25KB

    • MD5

      13a393f4abc0575a0c3661a2058c6a92

    • SHA1

      c35e88355d846094a9b9aeaef3822725cd65c898

    • SHA256

      685deaa148f2ded23bfac7a5bced8399f438b6825c48fa3c4d302470d4c23ad4

    • SHA512

      f33ef8ac7264a64982873a9dc7defff8c161376c59844047cf117b64d35c1d46c708e6fa03e7b2f999233816892ea6bad62f09a81112247502cf611904709ba6

    Score
    10/10
    njrathacked... w2bevasionpersistencesuricatatrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata

    • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

      suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

      suricata

    • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)

      suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)

      suricata

    • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)

      suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)

      suricata

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks