Overview

overview

10

Static

static

1

12.exe

windows7-x64

10

12.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    12.exe

  • Size

    2.3MB

  • Sample

    230220-q7yl5sbc37

  • MD5

    03abd18550cc6a9d86e1b952b857ec6c

  • SHA1

    22e6d070ebf2b35f53a025b734bc5bb504306607

  • SHA256

    deec6b6b69cbec63d25876628c13cedf96e9efccc7a043fe5dfaf2f6c3615f67

  • SHA512

    b98c39e80d200b3809778ae9b5d3113ff44c463fb18d6c4756f687d9e67c93256c2de86304399c6966715d3e29d99b8981da63a0d1f5095fe7cb15aa57b8f7da

  • SSDEEP

    24576:z8oFnrj/BLDrrP9rkccneVkGpEwDN9fQbnOwqi0oTl7Q0aRtsDsfHQ+EgZC/Iio8:woF/BNrJAGaWrNbJMlk0aAWHzLZCq96

Score
10/10
njratmybotagilenetpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

v4.0

Botnet

MyBot

C2

winter-rd.at.ply.gg:26394

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Targets

    • Target

      12.exe

    • Size

      2.3MB

    • MD5

      03abd18550cc6a9d86e1b952b857ec6c

    • SHA1

      22e6d070ebf2b35f53a025b734bc5bb504306607

    • SHA256

      deec6b6b69cbec63d25876628c13cedf96e9efccc7a043fe5dfaf2f6c3615f67

    • SHA512

      b98c39e80d200b3809778ae9b5d3113ff44c463fb18d6c4756f687d9e67c93256c2de86304399c6966715d3e29d99b8981da63a0d1f5095fe7cb15aa57b8f7da

    • SSDEEP

      24576:z8oFnrj/BLDrrP9rkccneVkGpEwDN9fQbnOwqi0oTl7Q0aRtsDsfHQ+EgZC/Iio8:woF/BNrJAGaWrNbJMlk0aAWHzLZCq96

    Score
    10/10
    njratmybotagilenetpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks