Overview

overview

10

Static

static

45420f1150...15.exe

windows7-x64

10

45420f1150...15.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    45420f1150a00fc1b74db78200c2d0e593e20a732586de6db59af7ba2a718715

  • Size

    532KB

  • Sample

    221123-s9d2magd9z

  • MD5

    0e96867b9627a91f834acad0e7b84e25

  • SHA1

    f9840c3a06ae977817ce14c831afd7c4ba7fabab

  • SHA256

    45420f1150a00fc1b74db78200c2d0e593e20a732586de6db59af7ba2a718715

  • SHA512

    966c3fb0cf56304d5919c894f5a8745156180fd82648b3241373918242791700cbca10f06d0cea49aaf386628a99f64c89df1db041677dc5134fdde17f29b1bd

  • SSDEEP

    6144:g1vZOZy/rCdul/Iw3Vn9dX8lzEmJDl3roqm+kP7zMv893WfIQZKnFWH+Lfw0sh:PZkrCkl/Z9dA7loqcq08I8KFk/h

Score
10/10
njratbillyevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

BILLY

C2

withgod.hopper.pw:770

Mutex

b84a37071759ef5cf75837e93f4b857b

Attributes
  • reg_key

    b84a37071759ef5cf75837e93f4b857b

  • splitter

    |'|'|

Targets

    • Target

      45420f1150a00fc1b74db78200c2d0e593e20a732586de6db59af7ba2a718715

    • Size

      532KB

    • MD5

      0e96867b9627a91f834acad0e7b84e25

    • SHA1

      f9840c3a06ae977817ce14c831afd7c4ba7fabab

    • SHA256

      45420f1150a00fc1b74db78200c2d0e593e20a732586de6db59af7ba2a718715

    • SHA512

      966c3fb0cf56304d5919c894f5a8745156180fd82648b3241373918242791700cbca10f06d0cea49aaf386628a99f64c89df1db041677dc5134fdde17f29b1bd

    • SSDEEP

      6144:g1vZOZy/rCdul/Iw3Vn9dX8lzEmJDl3roqm+kP7zMv893WfIQZKnFWH+Lfw0sh:PZkrCkl/Z9dA7loqcq08I8KFk/h

    Score
    10/10
    njratbillyevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks