Overview

overview

10

Static

static

10

6d26e923d1...c2.exe

windows7-x64

10

6d26e923d1...c2.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    ad2ed16ab7cd516c9c2c99c524b5081c.bin

  • Size

    17KB

  • Sample

    230801-cczn3adf6s

  • MD5

    a8a85d937b93ef39dc90079f0f82534a

  • SHA1

    a362045a500479e375e68d9883617a5a197a5a72

  • SHA256

    6f630e144c38b061d098b3719e487a391277dbf19ebfa7333da5066e8b656a3c

  • SHA512

    f435602847b08c86dafd1dd220f4ff7dbc1ed11fa6f2226883fe93351baf1fe5c508487aea91037f37514ed10fdca3d2c70707520c5a3069a73dd029dc506370

  • SSDEEP

    384:ORB1HWHOqsHcim8/12gqFXGrXZm3hfinlPYxFiGSvRF99xY+gIKC:kB1Qccim8/DqFGVhQxUG8RrQI7

Score
10/10
njrathackedpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

7.tcp.eu.ngrok.io:19100

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      6d26e923d1656ea020b1d60bf11f3c532d80a28f1e1ab2895cba6200202490c2.exe

    • Size

      43KB

    • MD5

      ad2ed16ab7cd516c9c2c99c524b5081c

    • SHA1

      da1105a560950c513cf4db8cf9e9a0d375c77f32

    • SHA256

      6d26e923d1656ea020b1d60bf11f3c532d80a28f1e1ab2895cba6200202490c2

    • SHA512

      9b14603b2938a52a618291fe1eb87a0c07cf5357672f2a3cc0acaa194aef4af81fc89f121fda93fc63e1bbf37c84e56ae3638e9051d87f4772bf5abfd2418153

    • SSDEEP

      384:h8ZyIQp3VarE8yTB1fqrkMwEnwDai0+TzEIij+ZsNO3PlpJKkkjh/TzF7pWntP/l:h6rC3MY5TnfqrxQDVuXQ/oQP3+L

    Score
    10/10
    njrathackedpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks