Overview

overview

10

Static

static

10

72688d88b6...c6.exe

windows7-x64

10

72688d88b6...c6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    72688d88b6bdfb4f04955ed75006045aacb9de6948060dfa5505ca78a63346c6

  • Size

    23KB

  • Sample

    221126-kl8x4aab5s

  • MD5

    cdf92f91faf572cb725365d2735a9ddc

  • SHA1

    52a34f5d356a0cfeb25e8f04b3daf18fd7c02780

  • SHA256

    72688d88b6bdfb4f04955ed75006045aacb9de6948060dfa5505ca78a63346c6

  • SHA512

    aebdb8ed07ea1c0861ad4254fe05cff9085aa23483a2a3c25205ae9e259d258a10ec63a57549bfe4ace7cb15091c7782512f6b9a6bb3999dc549aefeaab079c5

  • SSDEEP

    384:34Q+SAN7uprgvM5OSUswZXg69gbm4hfpFmRvR6JZlbw8hqIusZzZJZ:vOaxVULRpcnuk

Score
10/10
njrathackadevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Hackad

C2

kingmalkawe8.no-ip.biz:1177

Mutex

563dc7a986ccffe8ceee1dfeb426317e

Attributes
  • reg_key

    563dc7a986ccffe8ceee1dfeb426317e

  • splitter

    |'|'|

Targets

    • Target

      72688d88b6bdfb4f04955ed75006045aacb9de6948060dfa5505ca78a63346c6

    • Size

      23KB

    • MD5

      cdf92f91faf572cb725365d2735a9ddc

    • SHA1

      52a34f5d356a0cfeb25e8f04b3daf18fd7c02780

    • SHA256

      72688d88b6bdfb4f04955ed75006045aacb9de6948060dfa5505ca78a63346c6

    • SHA512

      aebdb8ed07ea1c0861ad4254fe05cff9085aa23483a2a3c25205ae9e259d258a10ec63a57549bfe4ace7cb15091c7782512f6b9a6bb3999dc549aefeaab079c5

    • SSDEEP

      384:34Q+SAN7uprgvM5OSUswZXg69gbm4hfpFmRvR6JZlbw8hqIusZzZJZ:vOaxVULRpcnuk

    Score
    10/10
    njrathackadevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks