Overview

overview

10

Static

static

10

e5c96ed542...8a.exe

windows7-x64

10

e5c96ed542...8a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    e5c96ed54212f17cd507c12f18936a5900ddbbbaa2d4764a345995c0038b7c8a

  • Size

    29KB

  • Sample

    221003-qg66laggg2

  • MD5

    6dae13b161718a9c78fce840f1796350

  • SHA1

    9b315f094763725873e59bf4f7bc6ef1e66094a7

  • SHA256

    e5c96ed54212f17cd507c12f18936a5900ddbbbaa2d4764a345995c0038b7c8a

  • SHA512

    091e21a915a64b0ef97fad7cc06bb5892c48ad475b025b4fb7a210104797261c985db1c820da4fbdeed17be71fd3088ad9c5641796a2eb1fdfabbdf92da9972c

  • SSDEEP

    384:4hpQjtl7jBnoKoK3JX15nHK4GumqDAEReIlGBsbh0w4wlAokw9OhgOL1vYRGOZzF:427hoKoGJFNK4Aq1RehBKh0p29SgRd/

Score
10/10
njrathackedevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

127.0.0.1:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes
  • reg_key

    5cd8f17f4086744065eb0992a09e05a2

  • splitter

    |'|'|

Targets

    • Target

      e5c96ed54212f17cd507c12f18936a5900ddbbbaa2d4764a345995c0038b7c8a

    • Size

      29KB

    • MD5

      6dae13b161718a9c78fce840f1796350

    • SHA1

      9b315f094763725873e59bf4f7bc6ef1e66094a7

    • SHA256

      e5c96ed54212f17cd507c12f18936a5900ddbbbaa2d4764a345995c0038b7c8a

    • SHA512

      091e21a915a64b0ef97fad7cc06bb5892c48ad475b025b4fb7a210104797261c985db1c820da4fbdeed17be71fd3088ad9c5641796a2eb1fdfabbdf92da9972c

    • SSDEEP

      384:4hpQjtl7jBnoKoK3JX15nHK4GumqDAEReIlGBsbh0w4wlAokw9OhgOL1vYRGOZzF:427hoKoGJFNK4Aq1RehBKh0p29SgRd/

    Score
    10/10
    njrathackedevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks