Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    35a04499338ae3ec8b0df0afc7b1fac5e052302ff0f16a18df9368bfc78f354d

  • Size

    29KB

  • Sample

    221126-ajdn3agh74

  • MD5

    51fc62ebbaea37b188705ba73f5a76af

  • SHA1

    021a0cc05bc7ccdb8efb832147881a4e64812e88

  • SHA256

    35a04499338ae3ec8b0df0afc7b1fac5e052302ff0f16a18df9368bfc78f354d

  • SHA512

    9839dcb4d5885ca1e152e6b826dffc5cd23491d2aeebc01036473a9bd4ed7839a8372ca886ac8c73dd28563b5f4c10a98a58bc4fedda0f71bf5494ae9f3ab752

  • SSDEEP

    384:dZCINl7rZt4AgSTnd5fGmjmumqD418+eYKGBsbh0w4wlAokw9OhgOL1vYRGOZzq/:d/7v4AgMdgmjAq8XeIBKh0p29SgRMl

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

mamostayanpoolllll.ddns.net:1177

Mutex

368fc7f563096ad51849f0d2c298fc08

Attributes
  • reg_key

    368fc7f563096ad51849f0d2c298fc08

  • splitter

    |'|'|

Targets

    • Target

      35a04499338ae3ec8b0df0afc7b1fac5e052302ff0f16a18df9368bfc78f354d

    • Size

      29KB

    • MD5

      51fc62ebbaea37b188705ba73f5a76af

    • SHA1

      021a0cc05bc7ccdb8efb832147881a4e64812e88

    • SHA256

      35a04499338ae3ec8b0df0afc7b1fac5e052302ff0f16a18df9368bfc78f354d

    • SHA512

      9839dcb4d5885ca1e152e6b826dffc5cd23491d2aeebc01036473a9bd4ed7839a8372ca886ac8c73dd28563b5f4c10a98a58bc4fedda0f71bf5494ae9f3ab752

    • SSDEEP

      384:dZCINl7rZt4AgSTnd5fGmjmumqD418+eYKGBsbh0w4wlAokw9OhgOL1vYRGOZzq/:d/7v4AgMdgmjAq8XeIBKh0p29SgRMl

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks