Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    71385a4a178b73fd11c12aad3a7cbc48

  • Size

    253KB

  • Sample

    240124-c226gsgcej

  • MD5

    71385a4a178b73fd11c12aad3a7cbc48

  • SHA1

    adb07aec1f9b15c8a04ef82ca38ef239a78d1f2a

  • SHA256

    cd520d8344f4956d0ce569b5ee20a075fd83d7fc1fb8102e66bd2374083c6144

  • SHA512

    d13dcd0685500caeac6d899ee2cd8ac3d9613de187d2dd34bce7f50dd3d58021a9a53fbc461c00efda72e14fea996f4482315e5adc8e22f8ada94a8bcf616d12

  • SSDEEP

    3072:z+2Fnk6ohLCIKBUMHtlKChtrLUDguaoxzk71Pue12R2aqQA3L36Nn7W:X1k6keIKGEtQOogTOzkZPumFcCka

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

mmnn.ddns.net:5552

Mutex

37d6ea9276d24b2d0fa12451b8b22b86

Attributes
  • reg_key

    37d6ea9276d24b2d0fa12451b8b22b86

  • splitter

    |'|'|

Targets

    • Target

      71385a4a178b73fd11c12aad3a7cbc48

    • Size

      253KB

    • MD5

      71385a4a178b73fd11c12aad3a7cbc48

    • SHA1

      adb07aec1f9b15c8a04ef82ca38ef239a78d1f2a

    • SHA256

      cd520d8344f4956d0ce569b5ee20a075fd83d7fc1fb8102e66bd2374083c6144

    • SHA512

      d13dcd0685500caeac6d899ee2cd8ac3d9613de187d2dd34bce7f50dd3d58021a9a53fbc461c00efda72e14fea996f4482315e5adc8e22f8ada94a8bcf616d12

    • SSDEEP

      3072:z+2Fnk6ohLCIKBUMHtlKChtrLUDguaoxzk71Pue12R2aqQA3L36Nn7W:X1k6keIKGEtQOogTOzkZPumFcCka

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Detected potential entity reuse from brand microsoft.

MITRE ATT&CK Enterprise v15

Tasks