Overview

overview

10

Static

static

c731c6f52d...3a.exe

windows7-x64

10

c731c6f52d...3a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c731c6f52d01da92c309ecc9a829ee60cd0f1d086fc9401d009f2544dad5b53a

  • Size

    39KB

  • Sample

    221002-2nk3gsdha7

  • MD5

    70da8625832e735f849fe5f47a1c74a0

  • SHA1

    2a2be89129db4d8ec8b20546f8d483afd73cb580

  • SHA256

    c731c6f52d01da92c309ecc9a829ee60cd0f1d086fc9401d009f2544dad5b53a

  • SHA512

    75995b207ff16adb5d6e38d097915e635987bd86e5de2a87479f9fc7095003da92ae47dcfe800c429b6fd68e5ccaac083e62fc922eb5fe37ee32231e2a933297

  • SSDEEP

    768:KhszVZgHPC02NU/9xaooDQj4QWjExdMzVX1d4bj:KhsBZYq0KTo26/xCrdgj

Score
10/10
njratmamaevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

mama

C2

nassimben.ddns.net:7771

Mutex

42c770b1825d53abeaba40d6b47fa5eb

Attributes
  • reg_key

    42c770b1825d53abeaba40d6b47fa5eb

  • splitter

    |'|'|

Targets

    • Target

      c731c6f52d01da92c309ecc9a829ee60cd0f1d086fc9401d009f2544dad5b53a

    • Size

      39KB

    • MD5

      70da8625832e735f849fe5f47a1c74a0

    • SHA1

      2a2be89129db4d8ec8b20546f8d483afd73cb580

    • SHA256

      c731c6f52d01da92c309ecc9a829ee60cd0f1d086fc9401d009f2544dad5b53a

    • SHA512

      75995b207ff16adb5d6e38d097915e635987bd86e5de2a87479f9fc7095003da92ae47dcfe800c429b6fd68e5ccaac083e62fc922eb5fe37ee32231e2a933297

    • SSDEEP

      768:KhszVZgHPC02NU/9xaooDQj4QWjExdMzVX1d4bj:KhsBZYq0KTo26/xCrdgj

    Score
    10/10
    njratmamaevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks