Overview

overview

10

Static

static

10

291957bae3...ef.exe

windows7-x64

10

291957bae3...ef.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    291957bae379206e49923abb253b2c7e1ac4e5284b3490d736aa396a1dc2baef

  • Size

    23KB

  • Sample

    221123-r3vv5aac78

  • MD5

    a56bfdad420792958d3cb2bdf4c09f3b

  • SHA1

    6a9cbb76b10dd5e2dce4f843bc53057d8a73d304

  • SHA256

    291957bae379206e49923abb253b2c7e1ac4e5284b3490d736aa396a1dc2baef

  • SHA512

    b539aad86a9880fdc674673afdbbaf30b819ca3e79e4b8e404302d83f64b13c665d430222784c6f43722333b76b447e12eefd5d4da006db27623f1ebe965e9b0

  • SSDEEP

    384:CwTSiYWD2Z7w3CsJeiecwJ3fw6FgzeAh33RtmRvR6JZlbw8hqIusZzZum7:hvZiBK1edJRpcnuh4

Score
10/10
njratsilent.thmevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

SILENT.THM

C2

silent1213.no-ip.biz:5552

Mutex

69f4a342b3ced3a141770e9ba14bb6e5

Attributes
  • reg_key

    69f4a342b3ced3a141770e9ba14bb6e5

  • splitter

    |'|'|

Targets

    • Target

      291957bae379206e49923abb253b2c7e1ac4e5284b3490d736aa396a1dc2baef

    • Size

      23KB

    • MD5

      a56bfdad420792958d3cb2bdf4c09f3b

    • SHA1

      6a9cbb76b10dd5e2dce4f843bc53057d8a73d304

    • SHA256

      291957bae379206e49923abb253b2c7e1ac4e5284b3490d736aa396a1dc2baef

    • SHA512

      b539aad86a9880fdc674673afdbbaf30b819ca3e79e4b8e404302d83f64b13c665d430222784c6f43722333b76b447e12eefd5d4da006db27623f1ebe965e9b0

    • SSDEEP

      384:CwTSiYWD2Z7w3CsJeiecwJ3fw6FgzeAh33RtmRvR6JZlbw8hqIusZzZum7:hvZiBK1edJRpcnuh4

    Score
    10/10
    njratsilent.thmevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks