Overview

overview

10

Static

static

10

bKB9.exe

windows7-x64

8

bKB9.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bKB9.exe

  • Size

    23KB

  • Sample

    230319-vn6wmahc56

  • MD5

    ca2ff13c2cffca5507ddd42ccaa397be

  • SHA1

    14785a8b6d0296fa41814c2e11818e5ca0d4352d

  • SHA256

    e235fa50b2fd6764c53eacb33714815824f4d0448fd5c6ac5ff6d6877eb66891

  • SHA512

    6c48d2cb6d4ac8137cb8d6d13df1439557b9d95921d0872af8169940c2fb58ef740fa7ff3fb0935f9b32a9c6943e93cb38fa6def62cb65ce4efd99ecad6a7db7

  • SSDEEP

    384:XoWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZ2B:w7O89p2rRpcnuZ

Score
10/10
njrathackedevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

2.tcp.ngrok.io:16052

Mutex

63155354d9df6bd69c496aff0dac1e22

Attributes
  • reg_key

    63155354d9df6bd69c496aff0dac1e22

  • splitter

    |'|'|

Targets

    • Target

      bKB9.exe

    • Size

      23KB

    • MD5

      ca2ff13c2cffca5507ddd42ccaa397be

    • SHA1

      14785a8b6d0296fa41814c2e11818e5ca0d4352d

    • SHA256

      e235fa50b2fd6764c53eacb33714815824f4d0448fd5c6ac5ff6d6877eb66891

    • SHA512

      6c48d2cb6d4ac8137cb8d6d13df1439557b9d95921d0872af8169940c2fb58ef740fa7ff3fb0935f9b32a9c6943e93cb38fa6def62cb65ce4efd99ecad6a7db7

    • SSDEEP

      384:XoWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZ2B:w7O89p2rRpcnuZ

    Score
    10/10
    evasionnjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks