Overview

overview

10

Static

static

Bank Paper.exe

windows7-x64

10

Bank Paper.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Bank Paper.exe
  • Size 6KB
  • Sample221023-1mmdgschdk
  • SHA256 f60fce8513f7e377cd397baa536a3d55fec6b106fcbd598117bb3c4fc41cdf04
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
njrathackedpersistencetrojan

Malware Config

Extracted

Family

  • njrat

Version

  • v2.0

Botnet

  • HacKed

C2

  • royaldanger.sytes.net:4042

Mutex

  • Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Targets

    • Target
      Bank Paper.exe
    • Size 6KB
    • SHA256 f60fce8513f7e377cd397baa536a3d55fec6b106fcbd598117bb3c4fc41cdf04
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    njrathackedpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks