Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    fa1a3a022778c23dac119cce05cdae97d244ec96cb1d8840d6cec28a4c3fd090

  • Size

    23KB

  • Sample

    221001-1waq2shbg3

  • MD5

    6bd895df9267c15d2a2c6d834b3b7560

  • SHA1

    812b885c9088203d6a314d336561e201b894c178

  • SHA256

    fa1a3a022778c23dac119cce05cdae97d244ec96cb1d8840d6cec28a4c3fd090

  • SHA512

    b93aaa721683c085caf51416b593ad9e23de7fbf29951d4a72b13eba84249db9dcad8b639e6d7b486078f7b68dcde44fd7531d4341f81345fc1ce08cd6779c5f

  • SSDEEP

    384:e+n2650N3qZbATcjRGC5Eo9D46BgnqUhay1ZmRvR6JZlbw8hqIusZzZXTZX:Rm+71d5XRpcnuQx

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

soukaina

C2

darkangel.no-ip.biz:5552

Mutex

cf51b302c8e06855dfbe2f4a8cb4411b

Attributes
  • reg_key

    cf51b302c8e06855dfbe2f4a8cb4411b

  • splitter

    |'|'|

Targets

    • Target

      fa1a3a022778c23dac119cce05cdae97d244ec96cb1d8840d6cec28a4c3fd090

    • Size

      23KB

    • MD5

      6bd895df9267c15d2a2c6d834b3b7560

    • SHA1

      812b885c9088203d6a314d336561e201b894c178

    • SHA256

      fa1a3a022778c23dac119cce05cdae97d244ec96cb1d8840d6cec28a4c3fd090

    • SHA512

      b93aaa721683c085caf51416b593ad9e23de7fbf29951d4a72b13eba84249db9dcad8b639e6d7b486078f7b68dcde44fd7531d4341f81345fc1ce08cd6779c5f

    • SSDEEP

      384:e+n2650N3qZbATcjRGC5Eo9D46BgnqUhay1ZmRvR6JZlbw8hqIusZzZXTZX:Rm+71d5XRpcnuQx

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks