Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    387066fa34cff110387fdef8dd7851f6.bin

  • Size

    13KB

  • Sample

    230412-cfyaeagh37

  • MD5

    3780d5d32d84989fbf22afc954cd0d8f

  • SHA1

    429772085e4dd112a15471bd81475e3a081d68e6

  • SHA256

    4e384c0e458406b96bf1a301ae25f49c77af2746a5be0884db76d03a7cb528de

  • SHA512

    58395916f12db80fdf5b6cebdd71176e355b581695910c844773ae9d7337e83d413c75b3f4fad2b85f9892918494000b1bd3318a0d072d8c6077da89ccd9be01

  • SSDEEP

    384:zpieWVjs9JBd169dT8jZ3b1T6Kv63nXwdwTUMHDMAV:zkzVgPA9+lbJfi3Ad3MnV

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

edge.servep2p.com:69

Mutex

813b829156a6c5f5b4a93593e8548ffd

Attributes
  • reg_key

    813b829156a6c5f5b4a93593e8548ffd

  • splitter

    |'|'|

Targets

    • Target

      ff7c120fbef25763588b82d27ffa2c3ac04dca2665f6f5d5e3aa0911b7a29012.exe

    • Size

      29KB

    • MD5

      387066fa34cff110387fdef8dd7851f6

    • SHA1

      c88610c2ae895a36a720947c300282b2b5559b4f

    • SHA256

      ff7c120fbef25763588b82d27ffa2c3ac04dca2665f6f5d5e3aa0911b7a29012

    • SHA512

      0b7c4b53ab0aa0ab26acafa85dad1a51853eb3cb1d949e07662126857d69b390d0141a87009f68356fd9bc1dc69de6823a8385b9f0555a92311849f585ad6265

    • SSDEEP

      384:ZSItl77FDFucYfKQCcHN5vljmOmqDIlXHeHNGBsbh0w4wlAokw9OhgOL1vYRGOZD:v77ucYfKQTtzjAqc3eUBKh0p29SgR+Y

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks