Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

New Project 1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    New Project 1.exe

  • Size

    7.9MB

  • Sample

    230308-atwmmace5v

  • MD5

    b1c2fc17bdfc63a9c9a38fd50b5ef56f

  • SHA1

    399bc3892ea9558b44c48c35a116e68ea10ffcbf

  • SHA256

    dc3ec70f6daa71429bee069cdce1d600db4ad9d054ac745dba2310c624d193fa

  • SHA512

    55f5e9c6b2f5bac36cd31c2ca69ff627eaecdf61abdb33f530744fcd352edda256a7079be0b261cbc6a7f20bb6940c1b1ff1b1e2a622a514647afa675957ef09

  • SSDEEP

    196608:eLo2IyBOU7KIUPwVRQTBmvuwIhCMwt1/okm:eM2T57KNPwVRQUfbfjtm

Score
10/10
njrathackedpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

considered-arrest.at.ply.gg:19159

Mutex

45dc89a20c39cab97b1d3cdf088b928f

Attributes
  • reg_key

    45dc89a20c39cab97b1d3cdf088b928f

  • splitter

    |'|'|

Targets

    • Target

      New Project 1.exe

    • Size

      7.9MB

    • MD5

      b1c2fc17bdfc63a9c9a38fd50b5ef56f

    • SHA1

      399bc3892ea9558b44c48c35a116e68ea10ffcbf

    • SHA256

      dc3ec70f6daa71429bee069cdce1d600db4ad9d054ac745dba2310c624d193fa

    • SHA512

      55f5e9c6b2f5bac36cd31c2ca69ff627eaecdf61abdb33f530744fcd352edda256a7079be0b261cbc6a7f20bb6940c1b1ff1b1e2a622a514647afa675957ef09

    • SSDEEP

      196608:eLo2IyBOU7KIUPwVRQTBmvuwIhCMwt1/okm:eM2T57KNPwVRQUfbfjtm

    Score
    10/10
    njrathackedpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v6

Tasks