Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0

  • Size

    104KB

  • Sample

    221001-3de9xsdaal

  • MD5

    612c66a36515026a56be7247c26fd640

  • SHA1

    6922a1cc14516d538e9e4eceb7e5fd8d1b13b15e

  • SHA256

    9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0

  • SHA512

    144ddf3583f3beb070da6af93c7aa568dfc48f312be6e233be45b1f11d0c68aea27671cbfc0da1ce260d43a96b352a34c296490f2addd345aba8ddb1eaddb9f5

  • SSDEEP

    1536:fv35cLcZpzG087Pb5xAr9DoM25s5jKXQqoXihO+NA43FizmPlQ:fugx8zb5OpDoSU2i0+fwOlQ

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

نورتني حبيبي

C2

pooi222.no-ip.biz:7777

Mutex

f478c0e74b869a31fe8f76f9aaf004a8

Attributes
  • reg_key

    f478c0e74b869a31fe8f76f9aaf004a8

  • splitter

    |'|'|

Targets

    • Target

      9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0

    • Size

      104KB

    • MD5

      612c66a36515026a56be7247c26fd640

    • SHA1

      6922a1cc14516d538e9e4eceb7e5fd8d1b13b15e

    • SHA256

      9053bf7c3206713597481ba4563833c03dece95115661c100bf3f54c9c5d57f0

    • SHA512

      144ddf3583f3beb070da6af93c7aa568dfc48f312be6e233be45b1f11d0c68aea27671cbfc0da1ce260d43a96b352a34c296490f2addd345aba8ddb1eaddb9f5

    • SSDEEP

      1536:fv35cLcZpzG087Pb5xAr9DoM25s5jKXQqoXihO+NA43FizmPlQ:fugx8zb5OpDoSU2i0+fwOlQ

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks