Overview

overview

10

Static

static

10

ee50e046b2...f8.exe

windows7-x64

10

ee50e046b2...f8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ee50e046b2a0adb88a996e57985071c19c7ab67f8947d5b3c30ea992c68538f8

  • Size

    116KB

  • Sample

    221126-de6qtsbc5z

  • MD5

    7b6abc0d6b931231f4e6caabb14133b9

  • SHA1

    c43d5a406ac73e91713856f99293d30b8c5ff05b

  • SHA256

    ee50e046b2a0adb88a996e57985071c19c7ab67f8947d5b3c30ea992c68538f8

  • SHA512

    2e93cd332214b6af4b86097d5453f7cd06618d0e8aaf0ea7f5d9ef3bae99c37fc2e0c51236f5aa6a92b6da94c0b5575e0f11a15f080cfa9d355c935b82f55e31

  • SSDEEP

    3072:sr85CrCtNKzZm2QJJ5R3JMchcEimov8fSgju:k9rCtY8rbhPfoxou

Score
10/10
neshtanjratمہٰسہٰتہٰشہٰار عہۧزرأئہۧيہۧل ضہۧآغہۧطہۧهہۧمے evasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

مہٰسہٰتہٰشہٰار عہۧزرأئہۧيہۧل ضہۧآغہۧطہۧهہۧمے

C2

my90.no-ip.org:9928

Mutex

8515eb34d8f9de5af815466e9715b3e5

Attributes
  • reg_key

    8515eb34d8f9de5af815466e9715b3e5

  • splitter

    |'|'|

Targets

    • Target

      ee50e046b2a0adb88a996e57985071c19c7ab67f8947d5b3c30ea992c68538f8

    • Size

      116KB

    • MD5

      7b6abc0d6b931231f4e6caabb14133b9

    • SHA1

      c43d5a406ac73e91713856f99293d30b8c5ff05b

    • SHA256

      ee50e046b2a0adb88a996e57985071c19c7ab67f8947d5b3c30ea992c68538f8

    • SHA512

      2e93cd332214b6af4b86097d5453f7cd06618d0e8aaf0ea7f5d9ef3bae99c37fc2e0c51236f5aa6a92b6da94c0b5575e0f11a15f080cfa9d355c935b82f55e31

    • SSDEEP

      3072:sr85CrCtNKzZm2QJJ5R3JMchcEimov8fSgju:k9rCtY8rbhPfoxou

    Score
    10/10
    neshtanjratمہٰسہٰتہٰشہٰار عہۧزرأئہۧيہۧل ضہۧآغہۧطہۧهہۧمے evasionpersistencespywarestealertrojan

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks