Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a9f841256176e553989ddda571efbd826e7a1290ccd915344e5cd7f3dbff0e06

  • Size

    29KB

  • Sample

    221125-3ldfasfa46

  • MD5

    539fc0ec68b05fe7516850d6408ba0a3

  • SHA1

    7851bcf3001ea1f930da624663f7f9f311ee1571

  • SHA256

    a9f841256176e553989ddda571efbd826e7a1290ccd915344e5cd7f3dbff0e06

  • SHA512

    acbbdc29bb4204913736e0147754c621d1ec216a9174000fc4f58ed3238bda9c316412ead0d35f5f797ea2d31d5bfabb8160d5aa0d3474f8d72c3e256c6fe102

  • SSDEEP

    384:1xUHEBl7p3hUw2s7bD55gEKemqDSqre/IDGBsbh0w4wlAokw9OhgOL1vYRGOZzSe:117bUw2C3kEcqNreHBKh0p29SgRk0

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

riyad213.sytes.net:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes
  • reg_key

    5cd8f17f4086744065eb0992a09e05a2

  • splitter

    |'|'|

Targets

    • Target

      a9f841256176e553989ddda571efbd826e7a1290ccd915344e5cd7f3dbff0e06

    • Size

      29KB

    • MD5

      539fc0ec68b05fe7516850d6408ba0a3

    • SHA1

      7851bcf3001ea1f930da624663f7f9f311ee1571

    • SHA256

      a9f841256176e553989ddda571efbd826e7a1290ccd915344e5cd7f3dbff0e06

    • SHA512

      acbbdc29bb4204913736e0147754c621d1ec216a9174000fc4f58ed3238bda9c316412ead0d35f5f797ea2d31d5bfabb8160d5aa0d3474f8d72c3e256c6fe102

    • SSDEEP

      384:1xUHEBl7p3hUw2s7bD55gEKemqDSqre/IDGBsbh0w4wlAokw9OhgOL1vYRGOZzSe:117bUw2C3kEcqNreHBKh0p29SgRk0

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks