Overview

overview

10

Static

static

10

Server.exe

windows7-x64

10

Server.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Server.exe

  • Size

    43KB

  • Sample

    230612-nr2bzscd8w

  • MD5

    621e4e49b03c78b3d7e5f3009d30ca7e

  • SHA1

    2c61e1935a571f299824c9014801dbedaa54f280

  • SHA256

    2c0033a6f0d9b0c8f0127ae6c7615b81acef43fef4f89bf89b9e329e7fdf9fb2

  • SHA512

    d91d03eb4896f35fd16ff249050461c732974c8bbfd608b4859258e0cde9c84ba4f8d7c11cefb611837ad32820d1d572fead2653ec50598cf9f2dff8208f9072

  • SSDEEP

    384:qZy0lO1STss7yKSxVYkEgEkurJS2dzsIij+ZsNO3PlpJKkkjh/TzF7pWnm/greTf:oHIk4smKSHYZxrEYuXQ/o/3+L

Score
10/10
njrathackedpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

7.tcp.eu.ngrok.io:7777

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      Server.exe

    • Size

      43KB

    • MD5

      621e4e49b03c78b3d7e5f3009d30ca7e

    • SHA1

      2c61e1935a571f299824c9014801dbedaa54f280

    • SHA256

      2c0033a6f0d9b0c8f0127ae6c7615b81acef43fef4f89bf89b9e329e7fdf9fb2

    • SHA512

      d91d03eb4896f35fd16ff249050461c732974c8bbfd608b4859258e0cde9c84ba4f8d7c11cefb611837ad32820d1d572fead2653ec50598cf9f2dff8208f9072

    • SSDEEP

      384:qZy0lO1STss7yKSxVYkEgEkurJS2dzsIij+ZsNO3PlpJKkkjh/TzF7pWnm/greTf:oHIk4smKSHYZxrEYuXQ/o/3+L

    Score
    10/10
    njrathackedpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks