Overview

overview

10

Static

static

10

0edd453764...9a.exe

windows7-x64

10

0edd453764...9a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0edd453764ea4156966727e07bcec79a.exe

  • Size

    47KB

  • Sample

    230112-3by91sbg62

  • MD5

    0edd453764ea4156966727e07bcec79a

  • SHA1

    892d9f39638b3b4046acaab4de5bfacb7335b4a2

  • SHA256

    5dce060530255df2db5e5dc505f505ad5d169e8c5586c189659a3ca0e8c0459d

  • SHA512

    24df614d28993df542caadac6a4c9819a083321fc0babd2ce73467ab53b4bdf5a82658eb84198be61d09ce97b68d1dd73c8f516f34ce8f29edb3103ad1cdda96

  • SSDEEP

    384:wZyqjwolYxOoyi0ytYcm6MNiMFQVa9D9O5UE5QzwBlpJNakkjh/TzF7pWnn1grel:2IouIli0kYDviqWvQO+er+L4X

Score
10/10
njratsystempersistencetrojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

system

C2

7.tcp.eu.ngrok.io:10504

Mutex

Discord Update

Attributes
  • reg_key

    Discord Update

  • splitter

    |Hassan|

Targets

    • Target

      0edd453764ea4156966727e07bcec79a.exe

    • Size

      47KB

    • MD5

      0edd453764ea4156966727e07bcec79a

    • SHA1

      892d9f39638b3b4046acaab4de5bfacb7335b4a2

    • SHA256

      5dce060530255df2db5e5dc505f505ad5d169e8c5586c189659a3ca0e8c0459d

    • SHA512

      24df614d28993df542caadac6a4c9819a083321fc0babd2ce73467ab53b4bdf5a82658eb84198be61d09ce97b68d1dd73c8f516f34ce8f29edb3103ad1cdda96

    • SSDEEP

      384:wZyqjwolYxOoyi0ytYcm6MNiMFQVa9D9O5UE5QzwBlpJNakkjh/TzF7pWnn1grel:2IouIli0kYDviqWvQO+er+L4X

    Score
    10/10
    njratsystempersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks