Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b510d18d2aa0a1c6e1f268fa888454d7.exe

  • Size

    287KB

  • Sample

    221225-e7874abb25

  • MD5

    b510d18d2aa0a1c6e1f268fa888454d7

  • SHA1

    6fa648be32432436ac88b5461a01a535b60a2892

  • SHA256

    9b128bead261e37e627633f1c1eaa0e242f0681b07074badfc03c0f59120a5b2

  • SHA512

    7e285b8d164633e82291a7089dccc9f37ebb364c87b6de5ffa2cd5cd0da701de998f01f43f82e8d612d262f8a163b1137373a4432eb95a6a8aa92243942a1bac

  • SSDEEP

    3072:eU0c0PAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZe:6+GIIIIIIIhIIIIIIIIIIIIIIIU

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

GargulecNaRacieSpoof

C2

5.249.160.56:2137

Mutex

1ce03857c4a192a1bd388be0ffabd5c2

Attributes
  • reg_key

    1ce03857c4a192a1bd388be0ffabd5c2

  • splitter

    |'|'|

Targets

    • Target

      b510d18d2aa0a1c6e1f268fa888454d7.exe

    • Size

      287KB

    • MD5

      b510d18d2aa0a1c6e1f268fa888454d7

    • SHA1

      6fa648be32432436ac88b5461a01a535b60a2892

    • SHA256

      9b128bead261e37e627633f1c1eaa0e242f0681b07074badfc03c0f59120a5b2

    • SHA512

      7e285b8d164633e82291a7089dccc9f37ebb364c87b6de5ffa2cd5cd0da701de998f01f43f82e8d612d262f8a163b1137373a4432eb95a6a8aa92243942a1bac

    • SSDEEP

      3072:eU0c0PAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZZZZZZe:6+GIIIIIIIhIIIIIIIIIIIIIIIU

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks