Overview

overview

10

Static

static

1

Office365 Checker.exe

windows7-x64

10

Office365 Checker.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Office365 Checker.exe

  • Size

    1015KB

  • Sample

    230329-htgsgagg8z

  • MD5

    13070b929870d933534ac2169adaffe7

  • SHA1

    4c6a9dedc8b85335e40f67786d025b2005a054f7

  • SHA256

    0bd0e4c5302be6496b439de8c8b86fed3e94eca9d803dce5b0d1ef8d08a14d35

  • SHA512

    732796485f8853b24adfbc7b7d7b58e5d4d95cd92cc20be547ba19ff27f89ac233763f4f370a1719290daf3a94f90a043528ee5f52dbe0b3fba87049f48d4922

  • SSDEEP

    12288:LDCmeZxmoAQhPmeZxmoYTmr4/YO2MoLOA0sU+nCpCBMutsN:fWJIWJbr4/YOroLyB+nCpQDts

Score
10/10
njrathackedevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

blog.hackcrack.io:8082

Mutex

Windows Explorer

Attributes
  • reg_key

    Windows Explorer

  • splitter

    |'|'|

Targets

    • Target

      Office365 Checker.exe

    • Size

      1015KB

    • MD5

      13070b929870d933534ac2169adaffe7

    • SHA1

      4c6a9dedc8b85335e40f67786d025b2005a054f7

    • SHA256

      0bd0e4c5302be6496b439de8c8b86fed3e94eca9d803dce5b0d1ef8d08a14d35

    • SHA512

      732796485f8853b24adfbc7b7d7b58e5d4d95cd92cc20be547ba19ff27f89ac233763f4f370a1719290daf3a94f90a043528ee5f52dbe0b3fba87049f48d4922

    • SSDEEP

      12288:LDCmeZxmoAQhPmeZxmoYTmr4/YO2MoLOA0sU+nCpCBMutsN:fWJIWJbr4/YOroLyB+nCpQDts

    Score
    10/10
    njrathackedevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks