Overview

overview

10

Static

static

10

76c17a1b37...f6.exe

windows7-x64

10

76c17a1b37...f6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    76c17a1b371fd2e93046ed8a2942f1f8c90aa96c03b5939a93ca9a7e8b429ef6

  • Size

    1.4MB

  • Sample

    221126-dfhqdsbc7t

  • MD5

    2cf9e95347cbf156b261f55ab4b1ac14

  • SHA1

    9130b5a89ccf69dd339f5bba85a0a7e90f0c133d

  • SHA256

    76c17a1b371fd2e93046ed8a2942f1f8c90aa96c03b5939a93ca9a7e8b429ef6

  • SHA512

    a29f9881f5ba746876605336f6942d5382851ed9ebd0051ead9c6020583b0031ac165c4bc04c477718606b635fee7899a449f63d43ecf35f84f8ef4ed3a56b11

  • SSDEEP

    24576:xExpt3BRETk20RnLhgUqH9Vpw5bgxxlkkGd7YJKRfJzsarAobfU7rrYddLC49wZP:x4pT20RnV1i9rw5EuJZQqvfU7Ad08mP

Score
10/10
neshtanjratمہٰسہٰتہٰشہٰار عہۧزرأئہۧيہۧل ضہۧآغہۧطہۧهہۧمے evasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

مہٰسہٰتہٰشہٰار عہۧزرأئہۧيہۧل ضہۧآغہۧطہۧهہۧمے

C2

my90.no-ip.org:1177

Mutex

8515eb34d8f9de5af815466e9715b3e5

Attributes
  • reg_key

    8515eb34d8f9de5af815466e9715b3e5

  • splitter

    |'|'|

Targets

    • Target

      76c17a1b371fd2e93046ed8a2942f1f8c90aa96c03b5939a93ca9a7e8b429ef6

    • Size

      1.4MB

    • MD5

      2cf9e95347cbf156b261f55ab4b1ac14

    • SHA1

      9130b5a89ccf69dd339f5bba85a0a7e90f0c133d

    • SHA256

      76c17a1b371fd2e93046ed8a2942f1f8c90aa96c03b5939a93ca9a7e8b429ef6

    • SHA512

      a29f9881f5ba746876605336f6942d5382851ed9ebd0051ead9c6020583b0031ac165c4bc04c477718606b635fee7899a449f63d43ecf35f84f8ef4ed3a56b11

    • SSDEEP

      24576:xExpt3BRETk20RnLhgUqH9Vpw5bgxxlkkGd7YJKRfJzsarAobfU7rrYddLC49wZP:x4pT20RnV1i9rw5EuJZQqvfU7Ad08mP

    Score
    10/10
    neshtanjratمہٰسہٰتہٰشہٰار عہۧزرأئہۧيہۧل ضہۧآغہۧطہۧهہۧمے evasionpersistencespywarestealertrojan

    • Detect Neshta payload

    • Modifies system executable filetype association

      persistence

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Change Default File Association

1
T1042

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks