Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    ef5ab7f0f4e7e83b532e082fe5c3458617f020b6b2ad6c83ffdb6f8ac2b1b37c

  • Size

    23KB

  • Sample

    221004-bezw6sehck

  • MD5

    6c1ca8fb6f463aa56f5f530480732880

  • SHA1

    817e4ed0453ecccafb94e89725e263b1d23c2c07

  • SHA256

    ef5ab7f0f4e7e83b532e082fe5c3458617f020b6b2ad6c83ffdb6f8ac2b1b37c

  • SHA512

    048b7b4b58c87814d2c713c43550d6db214e417b24c7757db53828b52ee90235c423dee451d9a4a4a3ca673a92e119b89b5661bd025211e231a58018be234384

  • SSDEEP

    384:8oWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZW5:r7O89p2rRpcnuR

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

radea.ddns.net:5552

Mutex

416b0a05138d6a81c601d80709573203

Attributes
  • reg_key

    416b0a05138d6a81c601d80709573203

  • splitter

    |'|'|

Targets

    • Target

      ef5ab7f0f4e7e83b532e082fe5c3458617f020b6b2ad6c83ffdb6f8ac2b1b37c

    • Size

      23KB

    • MD5

      6c1ca8fb6f463aa56f5f530480732880

    • SHA1

      817e4ed0453ecccafb94e89725e263b1d23c2c07

    • SHA256

      ef5ab7f0f4e7e83b532e082fe5c3458617f020b6b2ad6c83ffdb6f8ac2b1b37c

    • SHA512

      048b7b4b58c87814d2c713c43550d6db214e417b24c7757db53828b52ee90235c423dee451d9a4a4a3ca673a92e119b89b5661bd025211e231a58018be234384

    • SSDEEP

      384:8oWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZW5:r7O89p2rRpcnuR

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks