Overview
overview
1Static
static
1exploits/a...der.js
windows7-x64
1exploits/a...der.js
windows10-2004-x64
1exploits/exNetbios.js
windows7-x64
1exploits/exNetbios.js
windows10-2004-x64
1lsass2_spreader.js
windows7-x64
1lsass2_spreader.js
windows10-2004-x64
1untHTTPDownload.js
windows7-x64
1untHTTPDownload.js
windows10-2004-x64
1untNetbios.js
windows7-x64
1untNetbios.js
windows10-2004-x64
1untRunOnClose.js
windows7-x64
1untRunOnClose.js
windows10-2004-x64
1untSockets.js
windows7-x64
1untSockets.js
windows10-2004-x64
1untTCPIPPatcher.js
windows7-x64
1untTCPIPPatcher.js
windows10-2004-x64
1Static task
static1
Behavioral task
behavioral1
Sample
exploits/asn1_spreader.js
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
exploits/asn1_spreader.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral3
Sample
exploits/exNetbios.js
Resource
win7-20230220-en
Behavioral task
behavioral4
Sample
exploits/exNetbios.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral5
Sample
lsass2_spreader.js
Resource
win7-20230220-en
Behavioral task
behavioral6
Sample
lsass2_spreader.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral7
Sample
untHTTPDownload.js
Resource
win7-20230220-en
Behavioral task
behavioral8
Sample
untHTTPDownload.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral9
Sample
untNetbios.js
Resource
win7-20230220-en
Behavioral task
behavioral10
Sample
untNetbios.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral11
Sample
untRunOnClose.js
Resource
win7-20230220-en
Behavioral task
behavioral12
Sample
untRunOnClose.js
Resource
win10v2004-20230221-en
Behavioral task
behavioral13
Sample
untSockets.js
Resource
win7-20230220-en
Behavioral task
behavioral14
Sample
untSockets.js
Resource
win10v2004-20230220-en
Behavioral task
behavioral15
Sample
untTCPIPPatcher.js
Resource
win7-20230220-en
Behavioral task
behavioral16
Sample
untTCPIPPatcher.js
Resource
win10v2004-20230220-en
General
-
Target
rezo.ninjabot.zip
-
Size
95KB
-
MD5
5a0e13a825e520c785848653e1fca8f4
-
SHA1
d3e4035eb1f8420bc87bbd4f594bbdc99c4bc44a
-
SHA256
48f96623061d87ed6941ea84dce06763ae0e3f521a5d9ea56dbce01896c5763e
-
SHA512
5f243e49bb6f62aa88ce16fef326283db9b0b5d773837306633f6d0d8fc198b51678914f8d4e9684f728dd888163cd6ff2bc0e1c7afc78634bcfbd432e3a92a2
-
SSDEEP
1536:RMWGxUocIBKTCyPe5oXP49MYEmhZRg/ImzXTwHLErJ3fQl2Hucc2/TuNqNHtG4xI:RM3EIBfGSMKJmXwuu2ON2/ColIIIB
Malware Config
Signatures
Files
-
rezo.ninjabot.zip.zip
Password: infected
-
ELiRT.dcu
-
EliRT.pas
-
EliRT_OMF_B.obj
-
Ninja.ini
-
Readme.txt
-
TempNinja.dpr
-
exploits/asn1_spreader.pas.js
-
exploits/exASN.ini
-
exploits/exASN1.pas
-
exploits/exDCOM2.pas
-
exploits/exNetAPI.dcu
-
exploits/exNetAPI.pas
-
exploits/exNetApi.ini
-
exploits/exNetbios.dcu
-
exploits/exNetbios.pas.js
-
exploits/exPNP.dcu
-
exploits/exPNP.pas
-
exploits/exVNC.dcu
-
exploits/exVNC.pas
-
exploits/upnp_spreader.dcu
-
exploits/upnp_spreader.pas
-
lsass2_spreader.pas.js
-
lsass_const.pas
-
uStrList.pas
-
untBot.pas
-
untCrypt.pas
-
untFTPD.pas
-
untFunctions.pas
-
untGlobalDeclare.pas
-
untHTTPDownload.pas.js
-
untHoneyPot.pas
-
untNetbios.pas.js
-
untOutputs.pas
-
untRunOnClose.pas.js
-
untScanner.pas
-
untSockets.pas.js
-
untTCPIPPatcher.pas.js
-
untThreads.pas