Overview

overview

10

Static

static

10

57f91e1f57...16.exe

windows7-x64

10

57f91e1f57...16.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    57f91e1f571cab4315e253c888fab5c97682e7190dbc95a8aefe09aa4041e816

  • Size

    759KB

  • Sample

    220903-ca6plaffbm

  • MD5

    91521457b38bde22e7c4d774f032c86d

  • SHA1

    5fe081f552f7dc0ee67110b41c59b6bfa0531fcd

  • SHA256

    57f91e1f571cab4315e253c888fab5c97682e7190dbc95a8aefe09aa4041e816

  • SHA512

    8b671889d61ac54896b132c7e88eee9e12e445c7837a0c011eecb6371144e1b9c5193eed7379154b8d64cbe45e7ae4e6b228b0f4c0dfa13276fa67d22496fdc7

  • SSDEEP

    12288:HL1MeUoH3msuTmlOIq76xb35zdtKTKKpKKM2xHTc:/5gEMWx352xH

Score
10/10
njrathackedevasiontrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

4.tcp.eu.ngrok.io:7777

Mutex

a9613b7d22a0577c995b106d1cbb5571

Attributes
  • reg_key

    a9613b7d22a0577c995b106d1cbb5571

  • splitter

    |'|'|

Targets

    • Target

      57f91e1f571cab4315e253c888fab5c97682e7190dbc95a8aefe09aa4041e816

    • Size

      759KB

    • MD5

      91521457b38bde22e7c4d774f032c86d

    • SHA1

      5fe081f552f7dc0ee67110b41c59b6bfa0531fcd

    • SHA256

      57f91e1f571cab4315e253c888fab5c97682e7190dbc95a8aefe09aa4041e816

    • SHA512

      8b671889d61ac54896b132c7e88eee9e12e445c7837a0c011eecb6371144e1b9c5193eed7379154b8d64cbe45e7ae4e6b228b0f4c0dfa13276fa67d22496fdc7

    • SSDEEP

      12288:HL1MeUoH3msuTmlOIq76xb35zdtKTKKpKKM2xHTc:/5gEMWx352xH

    Score
    10/10
    njrathackedevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks