Overview

overview

10

Static

static

10

bRcl.exe

windows7-x64

10

bRcl.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bRcl.exe

  • Size

    23KB

  • Sample

    231031-hx1prabc64

  • MD5

    4147636832178d0029c0728397c563e3

  • SHA1

    4caa679de73f4733eef673228164f0e2da433ff7

  • SHA256

    138f3ba0bc1a8074a50b7c2d6c219c573987495dd897e594549bd2950f5d4072

  • SHA512

    1c24b5834cfb88f9d0e5faf377829fc826a72167a9704669657b5a5388d1bd14e667e0581ecda207e1fd27ec038944b9661dd8510de065fd0913c47c395ba397

  • SSDEEP

    384:boWSkWHa55BgDVRGipkItzY6vZg36Eh7FpmRvR6JZlbw8hqIusZzZPF:0Juk9pHRpcnuK

Score
10/10
njratlammerevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Lammer

C2

181.217.95.27:1024

Mutex

86230292ec2540faa33eb4bb71952fb5

Attributes
  • reg_key

    86230292ec2540faa33eb4bb71952fb5

  • splitter

    |'|'|

Targets

    • Target

      bRcl.exe

    • Size

      23KB

    • MD5

      4147636832178d0029c0728397c563e3

    • SHA1

      4caa679de73f4733eef673228164f0e2da433ff7

    • SHA256

      138f3ba0bc1a8074a50b7c2d6c219c573987495dd897e594549bd2950f5d4072

    • SHA512

      1c24b5834cfb88f9d0e5faf377829fc826a72167a9704669657b5a5388d1bd14e667e0581ecda207e1fd27ec038944b9661dd8510de065fd0913c47c395ba397

    • SSDEEP

      384:boWSkWHa55BgDVRGipkItzY6vZg36Eh7FpmRvR6JZlbw8hqIusZzZPF:0Juk9pHRpcnuK

    Score
    10/10
    njratevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks