Overview

overview

10

Static

static

3

17e8b8ca25...c2.exe

windows7-x64

10

17e8b8ca25...c2.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    17e8b8ca2511a8273d049a478d075fc2

  • Size

    349KB

  • Sample

    231224-212k1abca2

  • MD5

    17e8b8ca2511a8273d049a478d075fc2

  • SHA1

    3a473b8f7bbd4c878ffd9101482d164a6bbac60c

  • SHA256

    c093b4cd2ad7f9eaf3dc918333d6df78753ff18f71b4ac722862a7d8cf44031a

  • SHA512

    4094b0be82a62ac2d7ae08aeae432ba1a89ca9c40f7c5bfec19bbde529a8a0fdef56f19be63263936cab2dd429dbdd70df754d9ba35b45253597b99d15329429

  • SSDEEP

    6144:jXXXXXXXXXXXXXXXXXfqJuiHivvWxzfHWojlNBXNU+Y07sxKCYsRCgPtZXzgAtxs:

Score
10/10
njrathackevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Hack

C2

runtime.kro.kr:6522

Mutex

15ac00e92ea47b4f7ac4e4714b9affcb

Attributes
  • reg_key

    15ac00e92ea47b4f7ac4e4714b9affcb

  • splitter

    |'|'|

Targets

    • Target

      17e8b8ca2511a8273d049a478d075fc2

    • Size

      349KB

    • MD5

      17e8b8ca2511a8273d049a478d075fc2

    • SHA1

      3a473b8f7bbd4c878ffd9101482d164a6bbac60c

    • SHA256

      c093b4cd2ad7f9eaf3dc918333d6df78753ff18f71b4ac722862a7d8cf44031a

    • SHA512

      4094b0be82a62ac2d7ae08aeae432ba1a89ca9c40f7c5bfec19bbde529a8a0fdef56f19be63263936cab2dd429dbdd70df754d9ba35b45253597b99d15329429

    • SSDEEP

      6144:jXXXXXXXXXXXXXXXXXfqJuiHivvWxzfHWojlNBXNU+Y07sxKCYsRCgPtZXzgAtxs:

    Score
    10/10
    njrathackevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks