Overview

overview

10

Static

static

0552f81dac...39.exe

windows7-x64

10

0552f81dac...39.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0552f81dac0204225b13c3b096b8f29bc89e221b9245cb893e7af31869314939

  • Size

    6.6MB

  • Sample

    230129-x7qd4aah74

  • MD5

    4fa298a31dcb76657128b92350a0234e

  • SHA1

    29ad9d23a2fd10a697cd0128edec56803f29a1bb

  • SHA256

    0552f81dac0204225b13c3b096b8f29bc89e221b9245cb893e7af31869314939

  • SHA512

    7095b26dccf45ac0eea02a4b6ac3ce0812cc74818338cb171656d73886c3c0e38a8066e19390dd507df3b10dc14a72f18f655f300d959515fb92c406de798cec

  • SSDEEP

    196608:gb01x9LY/k8a+Le9jrv4b9YR4zLD+sfFxBgYirXGVafo:gb0f902BqiR4Dd7iYag

Score
10/10
njratrevengerathackedevasionpersistencestealertrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

loveuo11222.ddns.net:5552

Mutex

edf49507d18aa53c7edda61c9c878fa0

Attributes
  • reg_key

    edf49507d18aa53c7edda61c9c878fa0

  • splitter

    |'|'|

Extracted

Family

revengerat

Mutex

Targets

    • Target

      0552f81dac0204225b13c3b096b8f29bc89e221b9245cb893e7af31869314939

    • Size

      6.6MB

    • MD5

      4fa298a31dcb76657128b92350a0234e

    • SHA1

      29ad9d23a2fd10a697cd0128edec56803f29a1bb

    • SHA256

      0552f81dac0204225b13c3b096b8f29bc89e221b9245cb893e7af31869314939

    • SHA512

      7095b26dccf45ac0eea02a4b6ac3ce0812cc74818338cb171656d73886c3c0e38a8066e19390dd507df3b10dc14a72f18f655f300d959515fb92c406de798cec

    • SSDEEP

      196608:gb01x9LY/k8a+Le9jrv4b9YR4zLD+sfFxBgYirXGVafo:gb0f902BqiR4Dd7iYag

    Score
    10/10
    njratrevengerathackedevasionpersistencestealertrojan

    • RevengeRAT

      Remote-access trojan with a wide range of capabilities.

      trojanrevengerat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • RevengeRat Executable

      stealer

    • Executes dropped EXE

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks