Overview

overview

10

Static

static

de6c4e58cb...eb.exe

windows7-x64

10

de6c4e58cb...eb.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    de6c4e58cbab00c80e56b196a0e6197e5ba71bbd5c24e70cecc762ce2b84fbeb

  • Size

    405KB

  • Sample

    221126-2skmhsee5z

  • MD5

    d8775c56e4abff4c1dca41368aa66ba0

  • SHA1

    477211afcb62dc2626046e49aed123d6a23021bb

  • SHA256

    de6c4e58cbab00c80e56b196a0e6197e5ba71bbd5c24e70cecc762ce2b84fbeb

  • SHA512

    826057d35ed4979f7bfb607cb5da47e901c4da8162c28974fc09a9774918c68821a4f487d2869e280327c78f6584e3b121c1191dd0117d86249cd7af1e766fe0

  • SSDEEP

    6144:xuFQFkp4C0AYXXuyhC0DPMH951CpSoIIZHm8odsjpwlqS+QUqYA0lxoir:xuFB4z+yhCGyr1CpBIIZHscxo

Score
10/10
njratsaifellousevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

SaIFELLous

C2

saiflivy.no-ip.biz:1177

Mutex

ba4c12bee3027d94da5c81db2d196bfd

Attributes
  • reg_key

    ba4c12bee3027d94da5c81db2d196bfd

  • splitter

    |'|'|

Targets

    • Target

      de6c4e58cbab00c80e56b196a0e6197e5ba71bbd5c24e70cecc762ce2b84fbeb

    • Size

      405KB

    • MD5

      d8775c56e4abff4c1dca41368aa66ba0

    • SHA1

      477211afcb62dc2626046e49aed123d6a23021bb

    • SHA256

      de6c4e58cbab00c80e56b196a0e6197e5ba71bbd5c24e70cecc762ce2b84fbeb

    • SHA512

      826057d35ed4979f7bfb607cb5da47e901c4da8162c28974fc09a9774918c68821a4f487d2869e280327c78f6584e3b121c1191dd0117d86249cd7af1e766fe0

    • SSDEEP

      6144:xuFQFkp4C0AYXXuyhC0DPMH951CpSoIIZHm8odsjpwlqS+QUqYA0lxoir:xuFB4z+yhCGyr1CpBIIZHscxo

    Score
    10/10
    njratsaifellousevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks