Overview

overview

10

Static

static

10

083cf2b815...ac.exe

windows7-x64

10

083cf2b815...ac.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    083cf2b8153b97fe12cff304215ec8ac.exe

  • Size

    37KB

  • Sample

    220927-anxmqsddak

  • MD5

    083cf2b8153b97fe12cff304215ec8ac

  • SHA1

    5dc5d20ef9b4b13debbf0db1a4930f14990afa4a

  • SHA256

    eb0c3c93ac49a1c20a42fa82c5f1f81c1df01d05a0670342ea974b7d79308856

  • SHA512

    7bf10e9be2ada50a96cf5d2bd5d907f4521b177913e8759d96c16443c31e69cc752d9fb5e1b265048c311ef9a9e8b810b89ff92710a6a5af4710a40607cfa450

  • SSDEEP

    384:mu+vEiTbZvpWNcZ0y8f1CRDX5CLk6SgprAF+rMRTyN/0L+EcoinblneHQM3epzXI:T+dTZ38f1CRDcNSIrM+rMRa8Nu1Et

Score
10/10
njrathackedevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

lynnnaz.ddns.net:1703

Mutex

258c2f365319c9fd509866032c7dc587

Attributes
  • reg_key

    258c2f365319c9fd509866032c7dc587

  • splitter

    |'|'|

Targets

    • Target

      083cf2b8153b97fe12cff304215ec8ac.exe

    • Size

      37KB

    • MD5

      083cf2b8153b97fe12cff304215ec8ac

    • SHA1

      5dc5d20ef9b4b13debbf0db1a4930f14990afa4a

    • SHA256

      eb0c3c93ac49a1c20a42fa82c5f1f81c1df01d05a0670342ea974b7d79308856

    • SHA512

      7bf10e9be2ada50a96cf5d2bd5d907f4521b177913e8759d96c16443c31e69cc752d9fb5e1b265048c311ef9a9e8b810b89ff92710a6a5af4710a40607cfa450

    • SSDEEP

      384:mu+vEiTbZvpWNcZ0y8f1CRDX5CLk6SgprAF+rMRTyN/0L+EcoinblneHQM3epzXI:T+dTZ38f1CRDcNSIrM+rMRa8Nu1Et

    Score
    10/10
    njrathackedevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Impact

Tasks