Overview

overview

10

Static

static

10

1980-56-0x...ry.exe

windows7-x64

10

1980-56-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1980-56-0x0000000000A60000-0x0000000000A6C000-memory.dmp

  • Size

    48KB

  • Sample

    220813-z3cnjsebel

  • MD5

    3d0c9b1cbd007a79d0df93c6249a24bc

  • SHA1

    940e4787edaae8f71b10ae5574aa0267ec192341

  • SHA256

    ea1b0187bbd1a48bd632fddc7e2b367148e13827901cc06e10999a9b3baec8ef

  • SHA512

    4a9b6923ee468b45f05df607aa09f961ed262f3b4a5be5116d1335781c957edaecaf94513acc726b904241dc75b4ceb0a72d646f13674d4fa2da97d61664d2b3

Score
10/10
njrathackedevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

easralahtane.ddns.net:3973

Mutex

de691f5a23326e1eca32cf33144b3175

Attributes
  • reg_key

    de691f5a23326e1eca32cf33144b3175

  • splitter

    |'|'|

Targets

    • Target

      1980-56-0x0000000000A60000-0x0000000000A6C000-memory.dmp

    • Size

      48KB

    • MD5

      3d0c9b1cbd007a79d0df93c6249a24bc

    • SHA1

      940e4787edaae8f71b10ae5574aa0267ec192341

    • SHA256

      ea1b0187bbd1a48bd632fddc7e2b367148e13827901cc06e10999a9b3baec8ef

    • SHA512

      4a9b6923ee468b45f05df607aa09f961ed262f3b4a5be5116d1335781c957edaecaf94513acc726b904241dc75b4ceb0a72d646f13674d4fa2da97d61664d2b3

    Score
    10/10
    njrathackedevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks