Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    de0bd57617ea6b8e3354df4d3551eb5fc01954fab7ca2f697fe0e665048eb612

  • Size

    29KB

  • Sample

    221125-295zsaha6v

  • MD5

    28250c94c7cfdef4561173fb79c80dd5

  • SHA1

    de82aeb67fada6f57a05519de33b0160b9cb09c7

  • SHA256

    de0bd57617ea6b8e3354df4d3551eb5fc01954fab7ca2f697fe0e665048eb612

  • SHA512

    2e707312bff0da419578793f307f65d3c5f97a1c60784855c5c5514a0b6f04d022220ec261794c46fead1488248ec9a8ee26b1c377db6e9d893fec665f6b7e3f

  • SSDEEP

    384:tN2nLNl73t5otQMOdePp5TdNZmGmqD8ZneQqGBsbh0w4wlAokw9OhgOL1vYRGOZ1:tu7jo2MzBvb4qcneQBKh0p29SgR7l

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

rayan100010001000.no-ip.biz:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes
  • reg_key

    5cd8f17f4086744065eb0992a09e05a2

  • splitter

    |'|'|

Targets

    • Target

      de0bd57617ea6b8e3354df4d3551eb5fc01954fab7ca2f697fe0e665048eb612

    • Size

      29KB

    • MD5

      28250c94c7cfdef4561173fb79c80dd5

    • SHA1

      de82aeb67fada6f57a05519de33b0160b9cb09c7

    • SHA256

      de0bd57617ea6b8e3354df4d3551eb5fc01954fab7ca2f697fe0e665048eb612

    • SHA512

      2e707312bff0da419578793f307f65d3c5f97a1c60784855c5c5514a0b6f04d022220ec261794c46fead1488248ec9a8ee26b1c377db6e9d893fec665f6b7e3f

    • SSDEEP

      384:tN2nLNl73t5otQMOdePp5TdNZmGmqD8ZneQqGBsbh0w4wlAokw9OhgOL1vYRGOZ1:tu7jo2MzBvb4qcneQBKh0p29SgR7l

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks