Overview

overview

10

Static

static

089591f99c...d1.exe

windows7-x64

5

089591f99c...d1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    089591f99c69e6171f1cdf225fbf69c7fd35eea67cf6a6e7c87651484378f5d1

  • Size

    2.3MB

  • Sample

    221126-tsvhqabc4t

  • MD5

    686df444b5aba01a73b427ce6e1457ae

  • SHA1

    0c8fbdfa9f81585f0a7752ad0175ddb317bb24d7

  • SHA256

    089591f99c69e6171f1cdf225fbf69c7fd35eea67cf6a6e7c87651484378f5d1

  • SHA512

    159e766a9f8a673f5964c9f27654c0833d2a9162bc53e070351e932206c3a962937b12835efa556e06de48e43924da2903ff83dca6514fe3df2fe0db121e9ec0

  • SSDEEP

    24576:pwYZ4kGOYTnTDolUaNcTkkD9iSe87AAFmHs205LvLTV:uYpYTTDoXNcVoSe87FFmHB05Lv

Score
10/10
njratvictimetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

victime

C2

achiille1607b.no-ip.biz:1177

Mutex

4d8f1dc021f465efab135a3c3a22d781

Attributes
  • reg_key

    4d8f1dc021f465efab135a3c3a22d781

  • splitter

    |'|'|

Targets

    • Target

      089591f99c69e6171f1cdf225fbf69c7fd35eea67cf6a6e7c87651484378f5d1

    • Size

      2.3MB

    • MD5

      686df444b5aba01a73b427ce6e1457ae

    • SHA1

      0c8fbdfa9f81585f0a7752ad0175ddb317bb24d7

    • SHA256

      089591f99c69e6171f1cdf225fbf69c7fd35eea67cf6a6e7c87651484378f5d1

    • SHA512

      159e766a9f8a673f5964c9f27654c0833d2a9162bc53e070351e932206c3a962937b12835efa556e06de48e43924da2903ff83dca6514fe3df2fe0db121e9ec0

    • SSDEEP

      24576:pwYZ4kGOYTnTDolUaNcTkkD9iSe87AAFmHs205LvLTV:uYpYTTDoXNcVoSe87FFmHB05Lv

    Score
    10/10
    njratvictimetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks