Overview

overview

10

Static

static

10

winloker b....0.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    winloker builder 2.0.exe

  • Size

    37KB

  • Sample

    240218-lkh6qagh52

  • MD5

    91fcb1cea2f6c84da3c9622a070b7c4f

  • SHA1

    32fc093c2041e540ac41d2d0278a1ffb6a589dbd

  • SHA256

    c97418800bfc03f8f719b7924aa490cec520d2fd24266186b7b65fd86b3ebd6a

  • SHA512

    d7f46cdc20a4a01109971fb0135ea0a8d8fa763f2699c11bdbf5629c35818b49eef7615d982f5b1cb7edc240f3d6896e8d9864ab240747fc6c63a4c77f66790d

  • SSDEEP

    384:AU/KMizdLjnBhFbJ8ycP3hXZIwaihMrAF+rMRTyN/0L+EcoinblneHQM3epzXW3o://gLlLJfcP3hyNiOrM+rMRa8NuY4t

Score
10/10
njrathackevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

hack

C2

4.tcp.eu.ngrok.io:16090

Mutex

8b89dad6c018b3abd5aab0539a99437c

Attributes
  • reg_key

    8b89dad6c018b3abd5aab0539a99437c

  • splitter

    |'|'|

Targets

    • Target

      winloker builder 2.0.exe

    • Size

      37KB

    • MD5

      91fcb1cea2f6c84da3c9622a070b7c4f

    • SHA1

      32fc093c2041e540ac41d2d0278a1ffb6a589dbd

    • SHA256

      c97418800bfc03f8f719b7924aa490cec520d2fd24266186b7b65fd86b3ebd6a

    • SHA512

      d7f46cdc20a4a01109971fb0135ea0a8d8fa763f2699c11bdbf5629c35818b49eef7615d982f5b1cb7edc240f3d6896e8d9864ab240747fc6c63a4c77f66790d

    • SSDEEP

      384:AU/KMizdLjnBhFbJ8ycP3hXZIwaihMrAF+rMRTyN/0L+EcoinblneHQM3epzXW3o://gLlLJfcP3hyNiOrM+rMRa8NuY4t

    Score
    10/10
    njrathackevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

2
T1082

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks