Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    58cdd8fa24253a040d20f8c4c6d31cda

  • Size

    145KB

  • Sample

    240113-njsd4shcak

  • MD5

    58cdd8fa24253a040d20f8c4c6d31cda

  • SHA1

    533c54980e6326dfb99152d43e98e38f34e2fe9e

  • SHA256

    336c8fed6cd9d479f3e5ec0a9f0568397adfcdef9f739e8ff06074b96d29d94a

  • SHA512

    3089e7026cbd74ec8e5c36d08418e59539f38013a2069972e0b773fb3007f40e19b5f03c4d1d233b78a4c75be0f07802cc74b26242aee154c6d0c933fec4d9cf

  • SSDEEP

    768:MEVzp2tCSDo1fVzT50fKoeu9yf1VzkBuZNJB09Q6QvxYQaOR5UR4uVpskl0bF9Ni:aq84Nq2jH0izGVy4cx2X/clfAvIAI

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

8db4e7e20a6de47c86c8625b486c5fe3

Attributes
  • reg_key

    8db4e7e20a6de47c86c8625b486c5fe3

  • splitter

    |'|'|

Targets

    • Target

      58cdd8fa24253a040d20f8c4c6d31cda

    • Size

      145KB

    • MD5

      58cdd8fa24253a040d20f8c4c6d31cda

    • SHA1

      533c54980e6326dfb99152d43e98e38f34e2fe9e

    • SHA256

      336c8fed6cd9d479f3e5ec0a9f0568397adfcdef9f739e8ff06074b96d29d94a

    • SHA512

      3089e7026cbd74ec8e5c36d08418e59539f38013a2069972e0b773fb3007f40e19b5f03c4d1d233b78a4c75be0f07802cc74b26242aee154c6d0c933fec4d9cf

    • SSDEEP

      768:MEVzp2tCSDo1fVzT50fKoeu9yf1VzkBuZNJB09Q6QvxYQaOR5UR4uVpskl0bF9Ni:aq84Nq2jH0izGVy4cx2X/clfAvIAI

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks