Overview

overview

10

Static

static

42e716d8cc...94.vbs

windows7_x64

10

42e716d8cc...94.vbs

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    42e716d8cc902400baf2e972fdd9623b316e983179aac2f93b23e9458afa1894

  • Size

    286KB

  • Sample

    220707-yp4z7shhhm

  • MD5

    ebc8419277735f7c0b73efde624af797

  • SHA1

    54baa495f49b1c637038c3b2092c95f7c05b365d

  • SHA256

    42e716d8cc902400baf2e972fdd9623b316e983179aac2f93b23e9458afa1894

  • SHA512

    b0a8807b1bc2f00d6892a9af08f41dc6d74a8dc20e1ddda3f0073e38a6d6342402cc057e83dcf62d4685e37f9efe1d5fe94667d82599048b95c59536289ed603

Score
10/10
njrathackedevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

elbouma.hopto.org:1177

Mutex

488a2fbf3e0035bfa6bcca1a5413730c

Attributes
  • reg_key

    488a2fbf3e0035bfa6bcca1a5413730c

  • splitter

    |'|'|

Targets

    • Target

      42e716d8cc902400baf2e972fdd9623b316e983179aac2f93b23e9458afa1894

    • Size

      286KB

    • MD5

      ebc8419277735f7c0b73efde624af797

    • SHA1

      54baa495f49b1c637038c3b2092c95f7c05b365d

    • SHA256

      42e716d8cc902400baf2e972fdd9623b316e983179aac2f93b23e9458afa1894

    • SHA512

      b0a8807b1bc2f00d6892a9af08f41dc6d74a8dc20e1ddda3f0073e38a6d6342402cc057e83dcf62d4685e37f9efe1d5fe94667d82599048b95c59536289ed603

    Score
    10/10
    njrathackedevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks