Overview

overview

10

Static

static

10

ea1399bbd7...88.exe

windows7-x64

10

ea1399bbd7...88.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88

  • Size

    23KB

  • Sample

    221125-hmvezshc53

  • MD5

    9c2bf07e8852d4a499a19ae5f32d3b4c

  • SHA1

    25ce7fe13d4b5483571aa8d04b8dc666d3f4e27f

  • SHA256

    ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88

  • SHA512

    0f568a9ce888cdc48420cf41754fea7546a9719bcd1ccebc0be9b65a519abdaeac036f9a2f80268524c7466b47b2275b72fbd451c4c52155424274ff86ec1935

  • SSDEEP

    384:/sqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5D8mRvR6JZlbw8hqIusZzZyp:0f65K2Yf1jlRpcnuZ

Score
10/10
njrathackedevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

king-abci.no-ip.biz:1177

Mutex

0a6b51b7951398ae59007347009ae860

Attributes
  • reg_key

    0a6b51b7951398ae59007347009ae860

  • splitter

    |'|'|

Targets

    • Target

      ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88

    • Size

      23KB

    • MD5

      9c2bf07e8852d4a499a19ae5f32d3b4c

    • SHA1

      25ce7fe13d4b5483571aa8d04b8dc666d3f4e27f

    • SHA256

      ea1399bbd7cde5fc74a932311ebc3cfae76785c5e1b968749a263bb9e9ebca88

    • SHA512

      0f568a9ce888cdc48420cf41754fea7546a9719bcd1ccebc0be9b65a519abdaeac036f9a2f80268524c7466b47b2275b72fbd451c4c52155424274ff86ec1935

    • SSDEEP

      384:/sqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5D8mRvR6JZlbw8hqIusZzZyp:0f65K2Yf1jlRpcnuZ

    Score
    10/10
    njrathackedevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks