Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    3ece68411637a9f876d1576d7486cb553efccf1891959ab7b005ef68b296978e

  • Size

    1.1MB

  • Sample

    221001-1ljafaabbr

  • MD5

    6db1a6346a3b25ecbffa2935fb14ec80

  • SHA1

    62f8dc23aa747f01b4b88737de9bbdce907e3bdf

  • SHA256

    3ece68411637a9f876d1576d7486cb553efccf1891959ab7b005ef68b296978e

  • SHA512

    f030168a13c97ae14d24c89bd4076baf242a310d1618302bc391da0f594f0c6ff1e53458c857f3a1ee540809d91a8c4ffba31dffe1eab70a7b8f891b4bf727c6

  • SSDEEP

    12288:w4vSyN7kiUo/t1kI83H6HphukQteSrN7kiUo/t1k:w+97eI83EUeC7e

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Victim

C2

android321.no-ip.info:3030

Mutex

7d9b0bb0f2b1211165719becfc83c7dd

Attributes
  • reg_key

    7d9b0bb0f2b1211165719becfc83c7dd

  • splitter

    |'|'|

Targets

    • Target

      3ece68411637a9f876d1576d7486cb553efccf1891959ab7b005ef68b296978e

    • Size

      1.1MB

    • MD5

      6db1a6346a3b25ecbffa2935fb14ec80

    • SHA1

      62f8dc23aa747f01b4b88737de9bbdce907e3bdf

    • SHA256

      3ece68411637a9f876d1576d7486cb553efccf1891959ab7b005ef68b296978e

    • SHA512

      f030168a13c97ae14d24c89bd4076baf242a310d1618302bc391da0f594f0c6ff1e53458c857f3a1ee540809d91a8c4ffba31dffe1eab70a7b8f891b4bf727c6

    • SSDEEP

      12288:w4vSyN7kiUo/t1kI83H6HphukQteSrN7kiUo/t1k:w+97eI83EUeC7e

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v6

Tasks