Overview

overview

10

Static

static

10

3d8b2bc3fd...9f.exe

windows7-x64

10

3d8b2bc3fd...9f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    706fd9eb22adac23c973248375c50a02.bin

  • Size

    12KB

  • Sample

    230328-b3vx5agc85

  • MD5

    066e18f643de104bb95bda52d88204f8

  • SHA1

    029e698629c21a8bc099adc6bef5c263b886f4f1

  • SHA256

    fb1c1c9bb1eaccdf08ceef1410e835692c17a1ca58711a2994aa4d732e495abb

  • SHA512

    7e666ac9d0e800f5a44fb2e0d8413498a616fe07c1e761bf2fe861b0cbbaaab7582e98404a936f994a1fcb900c7b4578f657d4938465aa2dd64e82fe9ddc1ec3

  • SSDEEP

    192:QbGfaFAjC1Y0mVYgM0r8C6WQBTGBrSq0MLkMdTKbq2CjtmLum8Ko2UFEWcB:TaFbm2gWCMT4rR3dTKbq2C5KoR2

Score
10/10
njrathackedpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

bob541882.e2.luyouxia.net:20192

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Targets

    • Target

      3d8b2bc3fdba588bad1e6ee74050de7a31e386088636bbedf72f2285d3dc819f.exe

    • Size

      27KB

    • MD5

      706fd9eb22adac23c973248375c50a02

    • SHA1

      a2eb4719961cebca7a1e0ede2397c7e11e91a068

    • SHA256

      3d8b2bc3fdba588bad1e6ee74050de7a31e386088636bbedf72f2285d3dc819f

    • SHA512

      1e513b057abcebd61a5c808f026afeb16119172d8cde4e04a6d79997baa295c941a8594d0c39f1817117bbb94dba9c36f5a4bd81e123ab9fd0527bd6fadc42bf

    • SSDEEP

      384:hLOlYHHeIYTzJRcbg8iEPrthZMVAQk93vmhm7UMKmIEecKdbXTzm9bVhca66Zr6s:B2ZxJm8VA/vMHTi9bD

    Score
    10/10
    njrathackedpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Hidden Files and Directories

1
T1158

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks