Overview

overview

10

Static

static

10

ba36c9b8fe...eb.exe

windows7-x64

10

ba36c9b8fe...eb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ba36c9b8fec0735647e7984eb.exe

  • Size

    106KB

  • Sample

    230701-jkzglaga72

  • MD5

    ba36c9b8fec0735647e7984eb772aab3

  • SHA1

    91a2d15a954439e122daa782078e1e6c573de2a3

  • SHA256

    035c9d1fee3d2358a7fac27279dffdda55d3508e1503d91cb2fb4babf5319d12

  • SHA512

    a8779f8d586e752466e7311c2988bdb44fda6df520d77d1c6f90004de27890ea06f60a185a326ccd41afa9c14361bc7d8d4dab05578f922815866f017136c7fe

  • SSDEEP

    1536:e1+4dMS6ZueRX9mHUxOM1GeYjP1aed/y4Y3Gv:e10S6ZmUcvbjAed/nu

Score
10/10
njratinfectedevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Infected

C2

hakim32.ddns.net:2000

2.tcp.eu.ngrok.io:16032
Mutex

f0c8ea6d55ad279af54a02e293c5fcbd

Attributes
  • reg_key

    f0c8ea6d55ad279af54a02e293c5fcbd

  • splitter

    |'|'|

Targets

    • Target

      ba36c9b8fec0735647e7984eb.exe

    • Size

      106KB

    • MD5

      ba36c9b8fec0735647e7984eb772aab3

    • SHA1

      91a2d15a954439e122daa782078e1e6c573de2a3

    • SHA256

      035c9d1fee3d2358a7fac27279dffdda55d3508e1503d91cb2fb4babf5319d12

    • SHA512

      a8779f8d586e752466e7311c2988bdb44fda6df520d77d1c6f90004de27890ea06f60a185a326ccd41afa9c14361bc7d8d4dab05578f922815866f017136c7fe

    • SSDEEP

      1536:e1+4dMS6ZueRX9mHUxOM1GeYjP1aed/y4Y3Gv:e10S6ZmUcvbjAed/nu

    Score
    10/10
    njratinfectedevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Tasks