Overview

overview

10

Static

static

10

8f78be1cbd...92.exe

windows7-x64

10

8f78be1cbd...92.exe

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f78be1cbd42f277a7a8d4856f14ec6839b614f10de5b380c91b5a72e0bf6c92

  • Size

    23KB

  • Sample

    221124-18x24sga2v

  • MD5

    12b3218997c8176d6009f6ba17955584

  • SHA1

    2bef40f991c9d0a9fd86d32b0645590e923a804a

  • SHA256

    8f78be1cbd42f277a7a8d4856f14ec6839b614f10de5b380c91b5a72e0bf6c92

  • SHA512

    54eff1fff7d2b5796cea8588f29f71574c30ca3dbaff98eb0d43deb2db6e411464f76ea732da0d938d6f2032f345c2590a3c1e14fd4a8302c728658d63f992cc

  • SSDEEP

    384:GIGwz6+T4IjWZFNwXU0eiNUBdvt6lgT+lLOhXxQmRvR6JZlbw8hqIusZzZ16:GwTbC81NgRpcnuf

Score
10/10
njrathackedevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

f39002fad13fb54054d73f44d5542594

Attributes
  • reg_key

    f39002fad13fb54054d73f44d5542594

  • splitter

    |'|'|

Targets

    • Target

      8f78be1cbd42f277a7a8d4856f14ec6839b614f10de5b380c91b5a72e0bf6c92

    • Size

      23KB

    • MD5

      12b3218997c8176d6009f6ba17955584

    • SHA1

      2bef40f991c9d0a9fd86d32b0645590e923a804a

    • SHA256

      8f78be1cbd42f277a7a8d4856f14ec6839b614f10de5b380c91b5a72e0bf6c92

    • SHA512

      54eff1fff7d2b5796cea8588f29f71574c30ca3dbaff98eb0d43deb2db6e411464f76ea732da0d938d6f2032f345c2590a3c1e14fd4a8302c728658d63f992cc

    • SSDEEP

      384:GIGwz6+T4IjWZFNwXU0eiNUBdvt6lgT+lLOhXxQmRvR6JZlbw8hqIusZzZ16:GwTbC81NgRpcnuf

    Score
    10/10
    njrathackedevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks