Overview

overview

10

Static

static

f4903c07e2...dd.exe

windows7-x64

10

f4903c07e2...dd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4903c07e2162785d1b9d79fe5acfe8919059e548461959fd5bbf3ff3f560add

  • Size

    706KB

  • Sample

    221124-vgjgrabf2x

  • MD5

    7d0221cfad4f0d35c17b7210b005b3ba

  • SHA1

    6785c09aba569fa8c7faa6818d5243fe4e34cb2e

  • SHA256

    f4903c07e2162785d1b9d79fe5acfe8919059e548461959fd5bbf3ff3f560add

  • SHA512

    6b6943150f5580a45065c5ac2902bc41112331f6eca1e5ffbd5f448632375384e2cd0fcb6ce9fe042f1eddde1327e85d83965a170cd84a59bc12d9a6b4c50d9d

  • SSDEEP

    12288:fD9/Y3algourr1tS2Q6bFi84Z5Tdr8Obg5:fh/Y3AgoGSx4yDt

Score
10/10
njrathackedevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

sidoa3.no-ip.biz:5552

Mutex

5f2a3c9be5e573301d717ef17ad0d997

Attributes
  • reg_key

    5f2a3c9be5e573301d717ef17ad0d997

  • splitter

    |'|'|

Targets

    • Target

      f4903c07e2162785d1b9d79fe5acfe8919059e548461959fd5bbf3ff3f560add

    • Size

      706KB

    • MD5

      7d0221cfad4f0d35c17b7210b005b3ba

    • SHA1

      6785c09aba569fa8c7faa6818d5243fe4e34cb2e

    • SHA256

      f4903c07e2162785d1b9d79fe5acfe8919059e548461959fd5bbf3ff3f560add

    • SHA512

      6b6943150f5580a45065c5ac2902bc41112331f6eca1e5ffbd5f448632375384e2cd0fcb6ce9fe042f1eddde1327e85d83965a170cd84a59bc12d9a6b4c50d9d

    • SSDEEP

      12288:fD9/Y3algourr1tS2Q6bFi84Z5Tdr8Obg5:fh/Y3AgoGSx4yDt

    Score
    10/10
    njrathackedevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks