Overview

overview

10

Static

static

10

Clientpub.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Clientpub.exe

  • Size

    31KB

  • Sample

    240103-19cgsseab4

  • MD5

    df9a4cfc2e63623606c2bc5ad36e331f

  • SHA1

    38337a7e0e99f555c95032da52e3fed8174d9c41

  • SHA256

    485de354398cf7128900271acd438a9ef024ae30a6680a677c49e3615a92cee2

  • SHA512

    88e38ebf30a0cecfa3288d5dc7582417981f733f3a017e96a220482354eacbe10e1adac90e5caa64c5b7957f7861b9ce5d3ab29ab5d22402baad7596bf4e6775

  • SSDEEP

    768:kW1Z6U513vqzxl+r9UD3Z4gLv8wuQmIDUu0ticRj:OIqR48BuQVkVj

Score
10/10
njratmybotevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

C2

147.185.221.17:56266

Mutex

5c6d74c1d6da9f38491c5a3177b71988

Attributes
  • reg_key

    5c6d74c1d6da9f38491c5a3177b71988

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target

      Clientpub.exe

    • Size

      31KB

    • MD5

      df9a4cfc2e63623606c2bc5ad36e331f

    • SHA1

      38337a7e0e99f555c95032da52e3fed8174d9c41

    • SHA256

      485de354398cf7128900271acd438a9ef024ae30a6680a677c49e3615a92cee2

    • SHA512

      88e38ebf30a0cecfa3288d5dc7582417981f733f3a017e96a220482354eacbe10e1adac90e5caa64c5b7957f7861b9ce5d3ab29ab5d22402baad7596bf4e6775

    • SSDEEP

      768:kW1Z6U513vqzxl+r9UD3Z4gLv8wuQmIDUu0ticRj:OIqR48BuQVkVj

    Score
    10/10
    njratmybotevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks