Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    545936d3680850c9087bdb673fa66fdd

  • Size

    226KB

  • Sample

    240111-xxngrafcd4

  • MD5

    545936d3680850c9087bdb673fa66fdd

  • SHA1

    4738262182a002381e73cde4bf8c28a2715b5a3b

  • SHA256

    3f01a10dd4d8eaaa59bfcae88cf9b1a19d665e359f7dbb377212dbbffadefdf9

  • SHA512

    562b20b0fc085d24dd3e4724a60eefbc952f39ce87a079b1315fecf5b55c75da763b11d19cc22a83809fdd316238f9ca6054e61cbe4b6c40a423a8fc13c039f9

  • SSDEEP

    6144:7yWhXFYNcpgm2G797V7CvkziWkXAIBtEUetFTZdXTZdHXTZdXTZoHez744:7yW1eqpgmN9h7ukziWy9EUKFTZdXTZdX

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

62.227.124.106:5552

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Targets

    • Target

      545936d3680850c9087bdb673fa66fdd

    • Size

      226KB

    • MD5

      545936d3680850c9087bdb673fa66fdd

    • SHA1

      4738262182a002381e73cde4bf8c28a2715b5a3b

    • SHA256

      3f01a10dd4d8eaaa59bfcae88cf9b1a19d665e359f7dbb377212dbbffadefdf9

    • SHA512

      562b20b0fc085d24dd3e4724a60eefbc952f39ce87a079b1315fecf5b55c75da763b11d19cc22a83809fdd316238f9ca6054e61cbe4b6c40a423a8fc13c039f9

    • SSDEEP

      6144:7yWhXFYNcpgm2G797V7CvkziWkXAIBtEUetFTZdXTZdHXTZdXTZoHez744:7yW1eqpgmN9h7ukziWy9EUKFTZdXTZdX

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks