Overview

overview

10

Static

static

10

0x00080000...80.exe

windows7-x64

10

0x00080000...80.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0x000800000001230b-80.dat

  • Size

    133KB

  • Sample

    230314-g8qhgsdh42

  • MD5

    44affd0d82f9b8ef809053dba991a14a

  • SHA1

    e63398e4b374ffc20a0d3fea78dac657bd49f6de

  • SHA256

    d05edda2b7c085bbed3d5be4ba7b0dc00e807dfdcdcb67a30c9e24f96fed857b

  • SHA512

    703a8da05add8c126f1b95808226021d572156b3b5e1ef7f2da0414535ec40953cd3656f060faba40c62811aa2189d396e130bcfccc42bc9b116ff2e3d96d049

  • SSDEEP

    1536:JxqjQ+P04wsmJCSOojEwzGi1dD6DOgS4ygmlbrq+1NTZg:sr85CSOZi1dMzHynrq+1NTK

Score
10/10
neshtanjrathackedevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

Ni50Y3AuZXUubmdyb2suaW8Strik:MTA3MTI=

Mutex

9dd06b690cd90c449e471e22f62d779d

Attributes
  • reg_key

    9dd06b690cd90c449e471e22f62d779d

  • splitter

    |'|'|

Targets

    • Target

      0x000800000001230b-80.dat

    • Size

      133KB

    • MD5

      44affd0d82f9b8ef809053dba991a14a

    • SHA1

      e63398e4b374ffc20a0d3fea78dac657bd49f6de

    • SHA256

      d05edda2b7c085bbed3d5be4ba7b0dc00e807dfdcdcb67a30c9e24f96fed857b

    • SHA512

      703a8da05add8c126f1b95808226021d572156b3b5e1ef7f2da0414535ec40953cd3656f060faba40c62811aa2189d396e130bcfccc42bc9b116ff2e3d96d049

    • SSDEEP

      1536:JxqjQ+P04wsmJCSOojEwzGi1dD6DOgS4ygmlbrq+1NTZg:sr85CSOZi1dMzHynrq+1NTK

    Score
    10/10
    neshtanjrathackedevasionpersistencespywarestealertrojan

    • Detect Neshta payload

    • Neshta

      Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

      persistencespywareneshta

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Disables Task Manager via registry modification

      evasion

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Change Default File Association

1
T1042

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks