Overview

overview

10

Static

static

10

1660-14-0x...ry.exe

windows7-x64

10

1660-14-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1660-14-0x0000000000610000-0x0000000000650000-memory.dmp

  • Size

    256KB

  • Sample

    230824-qlmyhscg42

  • MD5

    df354d41cb9eeb6064629f54aa243450

  • SHA1

    b6056d4453385349d020fcf447bf19fccc800570

  • SHA256

    2b44054c257780f0297d3a39d48a8fddbd2a2c6e047b4d25dcbb33fdaf0cd7b7

  • SHA512

    5e3460ab89943032670eef6478587607a9658b1548b2a5596955b1209df452ac3795c35002c735fc16c441a11d01efecbcb42234cf29da46fc5750c788943ed3

  • SSDEEP

    1536:zvKO+4jwQVkLjMvBngxp0ICzoWdLGCQIXI1wEBn2a3pb4rw2UlvLf:99wTLagxp0IqoqnI1wg9Gr/Ut

Score
10/10
njratsystemevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

system

C2

147.50.253.241:6522

Mutex

e4d8b898672502b9751c26f7a748bd76

Attributes
  • reg_key

    e4d8b898672502b9751c26f7a748bd76

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target

      1660-14-0x0000000000610000-0x0000000000650000-memory.dmp

    • Size

      256KB

    • MD5

      df354d41cb9eeb6064629f54aa243450

    • SHA1

      b6056d4453385349d020fcf447bf19fccc800570

    • SHA256

      2b44054c257780f0297d3a39d48a8fddbd2a2c6e047b4d25dcbb33fdaf0cd7b7

    • SHA512

      5e3460ab89943032670eef6478587607a9658b1548b2a5596955b1209df452ac3795c35002c735fc16c441a11d01efecbcb42234cf29da46fc5750c788943ed3

    • SSDEEP

      1536:zvKO+4jwQVkLjMvBngxp0ICzoWdLGCQIXI1wEBn2a3pb4rw2UlvLf:99wTLagxp0IqoqnI1wg9Gr/Ut

    Score
    10/10
    njratsystemevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks