Overview

overview

10

Static

static

10

Payload.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payload.exe

  • Size

    100.1MB

  • Sample

    230103-zenqxacg88

  • MD5

    22a3e7b5b88e3879c056c8769b9cb03a

  • SHA1

    83ff230fc810b98072d07473d15695f3aab5ffc3

  • SHA256

    86638771fc9716d996c0ad6b25403eaf2b5f03059954c496fddf57092997c53d

  • SHA512

    242f205e3a10cf0667c6226303a0773f38c4ff152dc133edb793c3009ae4d914f34c03aea09f6d36f149f92c74ea06690176c28b55d88b1758b12197074f6880

  • SSDEEP

    1536:D0DgDnPoNs3SO1EtrDPwsNMDHXExI3pmBm:AgDn3iO1erDPwsNMDHXExI3pm

Score
10/10
njratvictimtrojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

C2

0.tcp.eu.ngrok.io:10483

Mutex

8958e12cf41da683c650e52f5d78a5ad

Attributes
  • reg_key

    8958e12cf41da683c650e52f5d78a5ad

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target

      Payload.exe

    • Size

      100.1MB

    • MD5

      22a3e7b5b88e3879c056c8769b9cb03a

    • SHA1

      83ff230fc810b98072d07473d15695f3aab5ffc3

    • SHA256

      86638771fc9716d996c0ad6b25403eaf2b5f03059954c496fddf57092997c53d

    • SHA512

      242f205e3a10cf0667c6226303a0773f38c4ff152dc133edb793c3009ae4d914f34c03aea09f6d36f149f92c74ea06690176c28b55d88b1758b12197074f6880

    • SSDEEP

      1536:D0DgDnPoNs3SO1EtrDPwsNMDHXExI3pmBm:AgDn3iO1erDPwsNMDHXExI3pm

    Score
    10/10
    njratvictimtrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1

MITRE ATT&CK Enterprise v6

Tasks