Overview

overview

10

Static

static

10

cbaef05f82...8e.exe

windows7-x64

10

cbaef05f82...8e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e

  • Size

    23KB

  • Sample

    221127-xywvhsfh81

  • MD5

    1b5d01ad390e8ca90fc4708a21f1b846

  • SHA1

    88a27e59b8ec194d96a6d5f947a888310f95bbe8

  • SHA256

    cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e

  • SHA512

    9fd898d36ea7630c31f470b07f97d3fd5f4b0ff8bf870fb7debea0df1dfe6b6ffe751cebdbc9283cfd33b2f9330066d6973c460b4aa9f9c5364a04c345e52586

  • SSDEEP

    384:PluBPiZCMfdfSJrQbsLRGSIxYeL46Dg/i8BD9BmRvR6JZlbw8hqIusZzZiZ:4OmhtItRpcnuF

Score
10/10
njrathacked evasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

bodylol2.no-ip.biz:1177

Mutex

42de0ab5567f78f85e9d2682d65bbf19

Attributes
  • reg_key

    42de0ab5567f78f85e9d2682d65bbf19

  • splitter

    |'|'|

Targets

    • Target

      cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e

    • Size

      23KB

    • MD5

      1b5d01ad390e8ca90fc4708a21f1b846

    • SHA1

      88a27e59b8ec194d96a6d5f947a888310f95bbe8

    • SHA256

      cbaef05f8225ce70a6103129c69ed19c1a3af6fd1136c43e435603be4aa4238e

    • SHA512

      9fd898d36ea7630c31f470b07f97d3fd5f4b0ff8bf870fb7debea0df1dfe6b6ffe751cebdbc9283cfd33b2f9330066d6973c460b4aa9f9c5364a04c345e52586

    • SSDEEP

      384:PluBPiZCMfdfSJrQbsLRGSIxYeL46Dg/i8BD9BmRvR6JZlbw8hqIusZzZiZ:4OmhtItRpcnuF

    Score
    10/10
    njrathacked evasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks