Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    01b904dc5f186fe1e4ff153b6de7c147.exe

  • Size

    93KB

  • Sample

    240125-ak7njacab2

  • MD5

    01b904dc5f186fe1e4ff153b6de7c147

  • SHA1

    c46357b7da70cf74016d9029eb3c07e896c0620b

  • SHA256

    0ed923fcea9dcb1d235a73cdfe30ff862c053e7d1843b0cd3b519c1f0e4ed3e1

  • SHA512

    a3a6cd4cfa388abd12e622067c1a4c26359be45807a016daacd11b52ad2ae9d2bd53710a14f334e7cca12aa1698e80c2f895eb711e5360b5c0a3e491a18a39bf

  • SSDEEP

    1536:6OmC+xhUa9urgOB9mNvM4jEwzGi1dDeDigS:6OgUa9urgOidGi1dwH

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

0.tcp.eu.ngrok.io:14937

Mutex

a542e6eb1db57185246fc4985b1f6593

Attributes
  • reg_key

    a542e6eb1db57185246fc4985b1f6593

  • splitter

    |'|'|

Targets

    • Target

      01b904dc5f186fe1e4ff153b6de7c147.exe

    • Size

      93KB

    • MD5

      01b904dc5f186fe1e4ff153b6de7c147

    • SHA1

      c46357b7da70cf74016d9029eb3c07e896c0620b

    • SHA256

      0ed923fcea9dcb1d235a73cdfe30ff862c053e7d1843b0cd3b519c1f0e4ed3e1

    • SHA512

      a3a6cd4cfa388abd12e622067c1a4c26359be45807a016daacd11b52ad2ae9d2bd53710a14f334e7cca12aa1698e80c2f895eb711e5360b5c0a3e491a18a39bf

    • SSDEEP

      1536:6OmC+xhUa9urgOB9mNvM4jEwzGi1dDeDigS:6OgUa9urgOidGi1dwH

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks