Overview

overview

10

Static

static

10

d5f936e094...42.exe

windows7-x64

10

d5f936e094...42.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d5f936e0948611fc301c4ca8b85fc1012356a3f6f83e09e7c959087a4d5d6442

  • Size

    23KB

  • Sample

    221123-s9c5bsgd9x

  • MD5

    5a8b08e5b56260b53bbf1222e3dda7b3

  • SHA1

    f035b6f669365f18329406c036d9428019cae1c4

  • SHA256

    d5f936e0948611fc301c4ca8b85fc1012356a3f6f83e09e7c959087a4d5d6442

  • SHA512

    6236b614444c293c8aeae0bd16d33ac48c6e8e299ff4004e3448a1a2a048c992a995012d94b0f0c767cdb686ded8296a41ec219d5b0c4ffd29fa73912602a706

  • SSDEEP

    384:zQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZHjd:k5yBVd7RpcnuC

Score
10/10
njrathackedevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

sahinerol1.no-ip.org:1221

Mutex

dc3fcc213130c10fcc359eeec1ff3b0f

Attributes
  • reg_key

    dc3fcc213130c10fcc359eeec1ff3b0f

  • splitter

    |'|'|

Targets

    • Target

      d5f936e0948611fc301c4ca8b85fc1012356a3f6f83e09e7c959087a4d5d6442

    • Size

      23KB

    • MD5

      5a8b08e5b56260b53bbf1222e3dda7b3

    • SHA1

      f035b6f669365f18329406c036d9428019cae1c4

    • SHA256

      d5f936e0948611fc301c4ca8b85fc1012356a3f6f83e09e7c959087a4d5d6442

    • SHA512

      6236b614444c293c8aeae0bd16d33ac48c6e8e299ff4004e3448a1a2a048c992a995012d94b0f0c767cdb686ded8296a41ec219d5b0c4ffd29fa73912602a706

    • SSDEEP

      384:zQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZHjd:k5yBVd7RpcnuC

    Score
    10/10
    njrathackedevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks