Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    37eadb2a6a140992e449eabfb0835d8f

  • Size

    402KB

  • Sample

    231231-qnyg2adfb3

  • MD5

    37eadb2a6a140992e449eabfb0835d8f

  • SHA1

    77cc4134b54cc4a07624e7b332713a08b7efc617

  • SHA256

    4a666cb1c605e9318e069c60f68589c67eeb6b30c49975a9189f15f2a6aab463

  • SHA512

    d521f6cb1ab2723bafc5093eb69c326ce65f48a6961eddb8107159663e60104cf38d9baaea18013939ced450d0e8b63960619f2a40c7cdb715226da51b769e24

  • SSDEEP

    6144:kmaKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgW:NSmLAuEY71fviagATFmebVQDcYc6

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

pdf

C2

hhhmach.ddns.net:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes
  • reg_key

    5cd8f17f4086744065eb0992a09e05a2

  • splitter

    |'|'|

Targets

    • Target

      37eadb2a6a140992e449eabfb0835d8f

    • Size

      402KB

    • MD5

      37eadb2a6a140992e449eabfb0835d8f

    • SHA1

      77cc4134b54cc4a07624e7b332713a08b7efc617

    • SHA256

      4a666cb1c605e9318e069c60f68589c67eeb6b30c49975a9189f15f2a6aab463

    • SHA512

      d521f6cb1ab2723bafc5093eb69c326ce65f48a6961eddb8107159663e60104cf38d9baaea18013939ced450d0e8b63960619f2a40c7cdb715226da51b769e24

    • SSDEEP

      6144:kmaKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgW:NSmLAuEY71fviagATFmebVQDcYc6

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks