Overview

overview

10

Static

static

aef2a2e45d...a0.exe

windows7-x64

10

aef2a2e45d...a0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0

  • Size

    137KB

  • Sample

    221001-ylmlraechq

  • MD5

    7290d6c5b840d629b677940ba7864850

  • SHA1

    46d8fdaf6386cd259ae9dc6fd273bfbc215f9b3b

  • SHA256

    aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0

  • SHA512

    94a7b9b36ccb1813708037a07cec10324d69cda9c7dc3f4db205489bf03af99868d933486093a07fdd0b4cba2a2050dd8a6ae00b4627c47f9f591c70ecfefea2

  • SSDEEP

    3072:Cnj9jtfU+INndIc0JQ5iKVk25T6nd8a9bK6PvA95hESK0A:CjbeimJTAd8d6n05hT0

Score
10/10
njrathackedevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

trung0979774557.homeip.net:5552

Mutex

192936889c1ad904a258ba1ec13299b3

Attributes
  • reg_key

    192936889c1ad904a258ba1ec13299b3

  • splitter

    |'|'|

Targets

    • Target

      aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0

    • Size

      137KB

    • MD5

      7290d6c5b840d629b677940ba7864850

    • SHA1

      46d8fdaf6386cd259ae9dc6fd273bfbc215f9b3b

    • SHA256

      aef2a2e45deff880a7b64d6f79e0b9441916afaa230440d07ca28e5560ff0ea0

    • SHA512

      94a7b9b36ccb1813708037a07cec10324d69cda9c7dc3f4db205489bf03af99868d933486093a07fdd0b4cba2a2050dd8a6ae00b4627c47f9f591c70ecfefea2

    • SSDEEP

      3072:Cnj9jtfU+INndIc0JQ5iKVk25T6nd8a9bK6PvA95hESK0A:CjbeimJTAd8d6n05hT0

    Score
    10/10
    njrathackedevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks