Overview

overview

10

Static

static

10

Server.exe

windows7_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Server.exe

  • Size

    37KB

  • Sample

    220708-m8g41abhfm

  • MD5

    61045a2a1b6d1f802ad27c756cb3948d

  • SHA1

    5d701b8124fe530f4e9e7dcc03df110b61be1754

  • SHA256

    02e08a42d8d05b95e82b8905ea78e24905b5f383e8085e73e5ec6bd6bbb5deb4

  • SHA512

    3e81d942cd968d8a32b989a953f82ee8653fffbe849535399f686dd32d646cb6e3a9186c52d960a29cbff03e1596ebcd7d38e5889c59c7fdfd74e8176158a509

Score
10/10
njratлошокevasionpersistencesuricatatrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

Лошок

C2

194.71.126.120:17954

Mutex

13d65a76848c880b980676c6c1cc6341

Attributes
  • reg_key

    13d65a76848c880b980676c6c1cc6341

  • splitter

    |'|'|

Targets

    • Target

      Server.exe

    • Size

      37KB

    • MD5

      61045a2a1b6d1f802ad27c756cb3948d

    • SHA1

      5d701b8124fe530f4e9e7dcc03df110b61be1754

    • SHA256

      02e08a42d8d05b95e82b8905ea78e24905b5f383e8085e73e5ec6bd6bbb5deb4

    • SHA512

      3e81d942cd968d8a32b989a953f82ee8653fffbe849535399f686dd32d646cb6e3a9186c52d960a29cbff03e1596ebcd7d38e5889c59c7fdfd74e8176158a509

    Score
    10/10
    njratлошокevasionpersistencesuricatatrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata

    • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

      suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

      suricata

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks