Overview

overview

10

Static

static

10

3244ed6c69...b0.exe

windows7-x64

10

3244ed6c69...b0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3244ed6c69af02208056c844dbd68c6e3ae124389541d8d2f5407c971c1aa3b0

  • Size

    29KB

  • Sample

    221125-dlmljabc9s

  • MD5

    eb966991411cfbbea754eb066e778824

  • SHA1

    a4087696b210fba28ef1681f79c4c694cbb5fc20

  • SHA256

    3244ed6c69af02208056c844dbd68c6e3ae124389541d8d2f5407c971c1aa3b0

  • SHA512

    700fc21c32c4e703d7fd97dcfcb61c356712cb87fb26fd9380df23ffbe02e754681f2d5d912e49f1cb91fafbe451006395bf5c27840d574f31dd31483e5e3c51

  • SSDEEP

    384:s7hkrLGN8fNl7L5H4yAyr9n95/K4ZoumqDYcqeYtGBsbh0w4wlAokw9OhgOL1vYX:s67R4yAy944Aq1qe5BKh0p29SgRdX

Score
10/10
njrathackedevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

xoxo.ddns.net:1177

Mutex

0c846cce211bf6f94acc2aadaa6e104d

Attributes
  • reg_key

    0c846cce211bf6f94acc2aadaa6e104d

  • splitter

    |'|'|

Targets

    • Target

      3244ed6c69af02208056c844dbd68c6e3ae124389541d8d2f5407c971c1aa3b0

    • Size

      29KB

    • MD5

      eb966991411cfbbea754eb066e778824

    • SHA1

      a4087696b210fba28ef1681f79c4c694cbb5fc20

    • SHA256

      3244ed6c69af02208056c844dbd68c6e3ae124389541d8d2f5407c971c1aa3b0

    • SHA512

      700fc21c32c4e703d7fd97dcfcb61c356712cb87fb26fd9380df23ffbe02e754681f2d5d912e49f1cb91fafbe451006395bf5c27840d574f31dd31483e5e3c51

    • SSDEEP

      384:s7hkrLGN8fNl7L5H4yAyr9n95/K4ZoumqDYcqeYtGBsbh0w4wlAokw9OhgOL1vYX:s67R4yAy944Aq1qe5BKh0p29SgRdX

    Score
    10/10
    njrathackedevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks