Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    4011c945eab342dfa34f753fb98a8903

  • Size

    65KB

  • Sample

    240104-gm2zdshhek

  • MD5

    4011c945eab342dfa34f753fb98a8903

  • SHA1

    abdf5d45451977d0aa451b34947de4459fe01c2e

  • SHA256

    af5fd63b145516de0fe79e709e30099e24f5099d0415c5ecff07b94e5f03ae7b

  • SHA512

    fada3b5a3370ac17194f9646e933c4c00735ba5ec30ae6abc7546bcc506d4ddc8474155add6ab6b4faf4963080d51791ecb25c05a677b3c042fa7b980dbc609a

  • SSDEEP

    1536:sEikUQ5Ke31oeYUnqmc/5arJpG96UzodEtp6ARiOm6Ozx:sE5rl/Nq9QIz8A8OmRx

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

⋘A♆A⋙

C2

hakim32.ddns.net:2000

Mutex

a5b3fa3acb0104014f92c69f9ef455a8

Attributes
  • reg_key

    a5b3fa3acb0104014f92c69f9ef455a8

  • splitter

    |'|'|

Targets

    • Target

      4011c945eab342dfa34f753fb98a8903

    • Size

      65KB

    • MD5

      4011c945eab342dfa34f753fb98a8903

    • SHA1

      abdf5d45451977d0aa451b34947de4459fe01c2e

    • SHA256

      af5fd63b145516de0fe79e709e30099e24f5099d0415c5ecff07b94e5f03ae7b

    • SHA512

      fada3b5a3370ac17194f9646e933c4c00735ba5ec30ae6abc7546bcc506d4ddc8474155add6ab6b4faf4963080d51791ecb25c05a677b3c042fa7b980dbc609a

    • SSDEEP

      1536:sEikUQ5Ke31oeYUnqmc/5arJpG96UzodEtp6ARiOm6Ozx:sE5rl/Nq9QIz8A8OmRx

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

    • Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v15

Tasks