Overview

overview

10

Static

static

10

92f8727ac6...12.exe

windows7-x64

10

92f8727ac6...12.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    92f8727ac61832086aef0d6445d602d25a08688f7a6e5f09556654a24df7aa12

  • Size

    29KB

  • Sample

    221003-bbhhqabcdr

  • MD5

    3ce85fe3e09e4362b85907bf72b85310

  • SHA1

    9ca267e54f0f93220ef04928b7baa254c8580d28

  • SHA256

    92f8727ac61832086aef0d6445d602d25a08688f7a6e5f09556654a24df7aa12

  • SHA512

    127480783bd3f797fd6dc2ae4db427ee1440927e08e58ab90612762b252a88bea277d5d0f452826409f23511cf86ca1441276a17ae275d1dc9e18e0047026241

  • SSDEEP

    384:uFUHEBl7p3hUw2s7bD55gEKJmqDSqre/IDGBsbh0w4wlAokw9OhgOL1vYRGOZzNr:u57bUw2C3kEpqNreHBKh0p29SgR/x

Score
10/10
njrathackedevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

klawess1.no-ip.org:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes
  • reg_key

    5cd8f17f4086744065eb0992a09e05a2

  • splitter

    |'|'|

Targets

    • Target

      92f8727ac61832086aef0d6445d602d25a08688f7a6e5f09556654a24df7aa12

    • Size

      29KB

    • MD5

      3ce85fe3e09e4362b85907bf72b85310

    • SHA1

      9ca267e54f0f93220ef04928b7baa254c8580d28

    • SHA256

      92f8727ac61832086aef0d6445d602d25a08688f7a6e5f09556654a24df7aa12

    • SHA512

      127480783bd3f797fd6dc2ae4db427ee1440927e08e58ab90612762b252a88bea277d5d0f452826409f23511cf86ca1441276a17ae275d1dc9e18e0047026241

    • SSDEEP

      384:uFUHEBl7p3hUw2s7bD55gEKJmqDSqre/IDGBsbh0w4wlAokw9OhgOL1vYRGOZzNr:u57bUw2C3kEpqNreHBKh0p29SgR/x

    Score
    10/10
    njrathackedtrojanevasion

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks