Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    52c0dd533b90b5bb90eb9c53398d92ea

  • Size

    212KB

  • Sample

    240111-gy5vesbdg4

  • MD5

    52c0dd533b90b5bb90eb9c53398d92ea

  • SHA1

    397b887d98cf1aecd2ecef2d35a3b0b3bbb3e036

  • SHA256

    e90335dd83ee86f20dff1a4bbc5837e6d64d79b5de05c3ce5eda06272048360c

  • SHA512

    7a7eb53137a1a4a88309f44a737cc6756f8ad0fa436efacb1e634420c0981b3e865e33288a8f07fa17064edb06552c7c4b685825b13dd318980c759f17cf4146

  • SSDEEP

    3072:XJacj8v7wQ+ZGx7w8wjjP8I1IU8RjrzzvUWAOZjfKdLOYU:XJPgv7wJZ87wBjYI1IUwrIOZyxU

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

Hacked

C2

abdo95.ddns.net:1177

Mutex

ed6e2bf930f6d35b3ac57c049d10ac2c

Attributes
  • reg_key

    ed6e2bf930f6d35b3ac57c049d10ac2c

  • splitter

    |'|'|

Targets

    • Target

      52c0dd533b90b5bb90eb9c53398d92ea

    • Size

      212KB

    • MD5

      52c0dd533b90b5bb90eb9c53398d92ea

    • SHA1

      397b887d98cf1aecd2ecef2d35a3b0b3bbb3e036

    • SHA256

      e90335dd83ee86f20dff1a4bbc5837e6d64d79b5de05c3ce5eda06272048360c

    • SHA512

      7a7eb53137a1a4a88309f44a737cc6756f8ad0fa436efacb1e634420c0981b3e865e33288a8f07fa17064edb06552c7c4b685825b13dd318980c759f17cf4146

    • SSDEEP

      3072:XJacj8v7wQ+ZGx7w8wjjP8I1IU8RjrzzvUWAOZjfKdLOYU:XJPgv7wJZ87wBjYI1IUwrIOZyxU

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks