Overview

overview

10

Static

static

10

niga.exe

windows10-1703-x64

niga.exe

windows7-x64

10

niga.exe

windows10-2004-x64

10

Resubmissions

09-04-2023 18:07

230409-wqq4macc86 10

09-04-2023 17:52

230409-wf5h9scc37 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    niga.exe

  • Size

    69KB

  • Sample

    230409-wf5h9scc37

  • MD5

    78cfee5877e0dc8298c063852d986fce

  • SHA1

    772af76ebad5d0a9b186b88bfe248d137587ab42

  • SHA256

    48d2deb6157a8365171fb07e8b41e1cb2ae6a2757f30814d8501c231484a4077

  • SHA512

    c002c1d88a3dbc72190e22bb0ebf3f502a8126b43704c083f114add555707a4b0c480e0af8b4edd9a1043137f9e5c4e33a6d8dcd84de716bebc932bb38a20f85

  • SSDEEP

    1536:VMHzzWTpYHzC8tIi0HchALTvbsbvA3teOWTkuLPZ9b3mrcxug0ZdRaEX1iNyaF97:VMHHWTpYHzC8t5aceLTAbvcwkWR9bPuI

Score
10/10
njratredlinehackedbootkitinfostealerpersistencestealertrojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:31440

Mutex

win64.exe

Attributes
  • reg_key

    win64.exe

  • splitter

    |Ghost|

Targets

    • Target

      niga.exe

    • Size

      69KB

    • MD5

      78cfee5877e0dc8298c063852d986fce

    • SHA1

      772af76ebad5d0a9b186b88bfe248d137587ab42

    • SHA256

      48d2deb6157a8365171fb07e8b41e1cb2ae6a2757f30814d8501c231484a4077

    • SHA512

      c002c1d88a3dbc72190e22bb0ebf3f502a8126b43704c083f114add555707a4b0c480e0af8b4edd9a1043137f9e5c4e33a6d8dcd84de716bebc932bb38a20f85

    • SSDEEP

      1536:VMHzzWTpYHzC8tIi0HchALTvbsbvA3teOWTkuLPZ9b3mrcxug0ZdRaEX1iNyaF97:VMHHWTpYHzC8t5aceLTAbvcwkWR9bPuI

    Score
    10/10
    njratredlinehackedbootkitinfostealerpersistencestealertrojan

    • Detects Redline Stealer samples

      This rule detects the presence of Redline Stealer samples based on their unique strings.

      stealer

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Writes to the Master Boot Record (MBR)

      Bootkits write to the MBR to gain persistence at a level below the operating system.

      bootkitpersistence
    behavioral1behavioral2behavioral3

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks