Overview

overview

10

Static

static

10

a056192dee...5c.exe

windows7-x64

10

a056192dee...5c.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a056192dee42155b609a49d2d2afe1e24b64b57221abb29f4179b45fcdae3d5c

  • Size

    22KB

  • Sample

    221124-1b3w4adh9z

  • MD5

    8294e24c474b5d08a6d73788b03ae3a1

  • SHA1

    2747d6aa1119a6b905e6874182df91b7d3f32f01

  • SHA256

    a056192dee42155b609a49d2d2afe1e24b64b57221abb29f4179b45fcdae3d5c

  • SHA512

    40c5e7f9cfe1bd8cf76c8e261c281d7a805f27118a7195949c05570ae3b67569478d0979bc469143c75c5cf708b896b9402ac162ea817eb4eb5f82f26d812f89

  • SSDEEP

    384:v/lUlFyGCJXc9x4YJclibSB0+8f1Q67gtwi5BbNmRvR6JZlbw8hqIusZzZEa3/:iy5wQ2SSxRpcnuTQ

Score
10/10
njratهههه ذكاءevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

هههه ذكاء

C2

foreverkoora.zapto.org:5552

Mutex

cdb389e93bedf2f4f25bb729e071ad97

Attributes
  • reg_key

    cdb389e93bedf2f4f25bb729e071ad97

  • splitter

    |'|'|

Targets

    • Target

      a056192dee42155b609a49d2d2afe1e24b64b57221abb29f4179b45fcdae3d5c

    • Size

      22KB

    • MD5

      8294e24c474b5d08a6d73788b03ae3a1

    • SHA1

      2747d6aa1119a6b905e6874182df91b7d3f32f01

    • SHA256

      a056192dee42155b609a49d2d2afe1e24b64b57221abb29f4179b45fcdae3d5c

    • SHA512

      40c5e7f9cfe1bd8cf76c8e261c281d7a805f27118a7195949c05570ae3b67569478d0979bc469143c75c5cf708b896b9402ac162ea817eb4eb5f82f26d812f89

    • SSDEEP

      384:v/lUlFyGCJXc9x4YJclibSB0+8f1Q67gtwi5BbNmRvR6JZlbw8hqIusZzZEa3/:iy5wQ2SSxRpcnuTQ

    Score
    10/10
    njratهههه ذكاءevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks