Overview

overview

10

Static

static

10

c56f7b9947...f3.exe

windows7-x64

8

c56f7b9947...f3.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    08b26b1bd71c6db9358c52230f0a87e2.bin

  • Size

    11KB

  • Sample

    230610-bc12fsef3s

  • MD5

    9c1a9f3ee3041a7276d1eb29b192a5a2

  • SHA1

    2c418a378b450d8274bdf4b524240634fa1522af

  • SHA256

    856f6f22459ab35ebafb4f12c6a3aa3e8252170ab9fe06595cbd2985d96c3783

  • SHA512

    b1d928bf7e316e5e537c6397b853c1efa11c5659705c3d3a5236d83fec9a35835a0f00fd81feb71c83230fe96ca3b550c4ee3174a33afd23716980b18b1564cd

  • SSDEEP

    192:h1q+6X5gZX8b2webOFuqfTUswSsJ3m/+39GK5+2kEY//cCzCwSHzuBlvb3i3O4PB:nkvRexG/wd/pg2e/cYCwkuBtjOl7FGuT

Score
10/10
njrathacked by code wcevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HACKED BY CODE WC

C2

laczin.duckdns.org:1177

Mutex

cc9fd5186c368372a70d5ebb96c720c0

Attributes
  • reg_key

    cc9fd5186c368372a70d5ebb96c720c0

  • splitter

    |'|'|

Targets

    • Target

      c56f7b994707861555b133c1826ddf02745007d10b457cf50172a170f5d933f3.exe

    • Size

      23KB

    • MD5

      08b26b1bd71c6db9358c52230f0a87e2

    • SHA1

      46b37b3294362c6039316d94096c8bb8d9efec07

    • SHA256

      c56f7b994707861555b133c1826ddf02745007d10b457cf50172a170f5d933f3

    • SHA512

      9169a55960eacba3122033543e30e731668fd0456b031d779fdf499dd5e51e630a10d2fceb341b72bf782c23101cf38f95790271d30fc3a9af4f7d62b164cd85

    • SSDEEP

      384:FXc68yCasVKDh3OQyNpsQ1im/VjJs+PyR46vg5J++p57nhmRvR6JZlbw8hqIusZ6:FD873Kt+QesGN/VjZPQRpcnuL

    Score
    10/10
    evasionpersistencenjrattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks