Overview

overview

10

Static

static

10

41e16a3ec1...bb.exe

windows7_x64

10

41e16a3ec1...bb.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    41e16a3ec19884f7c34b1257a06d7b3e9a2a1dba11354081b0a57136c97032bb

  • Size

    23KB

  • Sample

    220708-exewhabbh9

  • MD5

    305d5a7d908b9d6c99c5367b009ad441

  • SHA1

    440fc4dffa4839a057fe56e208c1a7719395cf38

  • SHA256

    41e16a3ec19884f7c34b1257a06d7b3e9a2a1dba11354081b0a57136c97032bb

  • SHA512

    e06f8b17bdebc1cb08bad0d39f758a53dd0ebc28f52f6bba9f1aef2a1d2859d436bfcd429e60c55a98a5bb75389dcec212ca3e6f4df88c76582042fba8c5c910

Score
10/10
njratpatoevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

PATO

C2

kaka200222.ddns.net:1604

Mutex

b7d8ea7d9151c37c324eaa86550b0c07

Attributes
  • reg_key

    b7d8ea7d9151c37c324eaa86550b0c07

  • splitter

    |'|'|

Targets

    • Target

      41e16a3ec19884f7c34b1257a06d7b3e9a2a1dba11354081b0a57136c97032bb

    • Size

      23KB

    • MD5

      305d5a7d908b9d6c99c5367b009ad441

    • SHA1

      440fc4dffa4839a057fe56e208c1a7719395cf38

    • SHA256

      41e16a3ec19884f7c34b1257a06d7b3e9a2a1dba11354081b0a57136c97032bb

    • SHA512

      e06f8b17bdebc1cb08bad0d39f758a53dd0ebc28f52f6bba9f1aef2a1d2859d436bfcd429e60c55a98a5bb75389dcec212ca3e6f4df88c76582042fba8c5c910

    Score
    10/10
    njratpatoevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks