Overview

overview

10

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    https://cdn.discordapp.com/attachments/1157926082046087209/1157984935236345856/Server.exe?ex=651a9902&is=65194782&hm=8d8383e30c6e9367f51596774f6fa35d3b40a22d6568aac6ad3b11d568ae6583&

  • Sample

    231001-mcdrpsbd83

Score
10/10
njrathackedevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

147.185.221.16:57012
Mutex

67b58e0872c1b83ef9c9f017e194d03d

Attributes
  • reg_key

    67b58e0872c1b83ef9c9f017e194d03d

  • splitter

    |'|'|

Targets

    • Target

      https://cdn.discordapp.com/attachments/1157926082046087209/1157984935236345856/Server.exe?ex=651a9902&is=65194782&hm=8d8383e30c6e9367f51596774f6fa35d3b40a22d6568aac6ad3b11d568ae6583&

    Score
    10/10
    njrathackedevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks