Overview

overview

10

Static

static

3

49bf33f0b0...55.exe

windows7-x64

10

49bf33f0b0...55.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    49bf33f0b08d37da284f8639c1f00055

  • Size

    40KB

  • Sample

    240107-zr5j7aedbn

  • MD5

    49bf33f0b08d37da284f8639c1f00055

  • SHA1

    3695046661213ba96b279bea83aabde19ec1a03f

  • SHA256

    50c4981ce9e9bf59c4618e173962dba774131dcbd0822ea2a7126ecf4856b194

  • SHA512

    53999c4ea4852bdfce596624b5fce5df1ede2435399cefb0845d23e3c84c1ad284e62e31abf0119efdb9d829fe03123d5eb16132eaa729731a98e5d86c1313db

  • SSDEEP

    192:/TBBdaStRucohNosFOX0GPGJnelDwyX9rUX:/TjMFhNosYHGJUDwyXRUX

Score
10/10
njratjajaevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

jaja

C2

127.0.0.1:442

Mutex

74caf6ac20895d0081b0f902a5e18339

Attributes
  • reg_key

    74caf6ac20895d0081b0f902a5e18339

  • splitter

    |'|'|

Targets

    • Target

      49bf33f0b08d37da284f8639c1f00055

    • Size

      40KB

    • MD5

      49bf33f0b08d37da284f8639c1f00055

    • SHA1

      3695046661213ba96b279bea83aabde19ec1a03f

    • SHA256

      50c4981ce9e9bf59c4618e173962dba774131dcbd0822ea2a7126ecf4856b194

    • SHA512

      53999c4ea4852bdfce596624b5fce5df1ede2435399cefb0845d23e3c84c1ad284e62e31abf0119efdb9d829fe03123d5eb16132eaa729731a98e5d86c1313db

    • SSDEEP

      192:/TBBdaStRucohNosFOX0GPGJnelDwyX9rUX:/TjMFhNosYHGJUDwyXRUX

    Score
    10/10
    njratjajaevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks