Overview

overview

10

Static

static

10

cb75f57bef...78.exe

windows7-x64

8

cb75f57bef...78.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078

  • Size

    23KB

  • Sample

    221001-y51ygsebb9

  • MD5

    69fd8c75298e3c9a98f8cad5321d0220

  • SHA1

    abef1bf2740d680aca21000c7fb0d7feb0ceeca3

  • SHA256

    cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078

  • SHA512

    83d53d16a69494491368d8669316f5d1a9dfdd42074773919c6174d4cdc6cfc98e0efb1dbdbb0f0528efb5e2549ec99f452d3a33aa6dde5dbf95853a01c42eb3

  • SSDEEP

    384:bc68yCaUVIhboNgfEimfkNzayS06vg5UhcpxH7ndmRvR6JZlbw8hqIusZzZDI:3873kgNfoaf6ARpcnu7

Score
10/10
njrathackedevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:27015

Mutex

e59e1159116107350437e00718e35620

Attributes
  • reg_key

    e59e1159116107350437e00718e35620

  • splitter

    |'|'|

Targets

    • Target

      cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078

    • Size

      23KB

    • MD5

      69fd8c75298e3c9a98f8cad5321d0220

    • SHA1

      abef1bf2740d680aca21000c7fb0d7feb0ceeca3

    • SHA256

      cb75f57beffcc7b1590a230e746812e303f7e37682c49a7b9fd7ac6f2dd5b078

    • SHA512

      83d53d16a69494491368d8669316f5d1a9dfdd42074773919c6174d4cdc6cfc98e0efb1dbdbb0f0528efb5e2549ec99f452d3a33aa6dde5dbf95853a01c42eb3

    • SSDEEP

      384:bc68yCaUVIhboNgfEimfkNzayS06vg5UhcpxH7ndmRvR6JZlbw8hqIusZzZDI:3873kgNfoaf6ARpcnu7

    Score
    10/10
    evasionnjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks