Overview

overview

10

Static

static

10

New folder/Server.exe

windows7-x64

10

New folder/Server.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    eadf9641da1d323a57ebbfb288bfb1a0626261085a1b602f5b33c72d43ab5d84

  • Size

    12KB

  • Sample

    221126-klyr5aab31

  • MD5

    b02f4ac8ccb35ce00691dc6a601c0e34

  • SHA1

    1a2b234054d0a976cc8961cc22303d1ccd44827c

  • SHA256

    eadf9641da1d323a57ebbfb288bfb1a0626261085a1b602f5b33c72d43ab5d84

  • SHA512

    820519bd799c0abfdd33904a975445f98e31f92a7e2a7f15892cc7bcd095a9cb6db78db2d95352db71340d11684154bab1ff7c5de2d8d401cea7ecc4141d8077

  • SSDEEP

    384:pCm/I5DAOCjRNr2vnQnw9vAJ0iDWpAKotHIhmuHoimR05D:pD40Owzrlb0iyAztMHoQ

Score
10/10
njrathacked by nakam shahoevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed by nakam shaho

C2

mnqatqathackernym.no-ip.biz:1177

Mutex

64a42e84d1120cee8b629a40cb27856e

Attributes
  • reg_key

    64a42e84d1120cee8b629a40cb27856e

  • splitter

    |'|'|

Targets

    • Target

      New folder/Server.exe

    • Size

      29KB

    • MD5

      49d64e0fdbcc8fdb216a478fe40d3c4a

    • SHA1

      871e1de9e7f1e8feff0d52d576fda4ab003e5029

    • SHA256

      e98efaeeeba4df9a8258086be9b627f92d3509a88c0e7f980677d0abf55149ae

    • SHA512

      f159f81a3c86d1a08a1fdde51e5d6c5b877a10255dbd74f316f08d57baa5eee9df9a45b6180938cb8e5da30fd31b8ee6d53076b5938b913a1fdb032558e73458

    • SSDEEP

      768:C7cIsKCi5+UrsqUxBejlwBKh0p29SgRcS:C7lvQ9AlWKhG29jcS

    Score
    10/10
    njrathacked by nakam shahotrojanevasionpersistence

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks