Overview

overview

10

Static

static

10

15963fa208...ff.exe

windows7-x64

10

15963fa208...ff.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    15963fa2085ea360f528506bd5f515d2f61bb0c456e6ca91ea814de62039ceff

  • Size

    31.4MB

  • Sample

    240303-bsl78sba4x

  • MD5

    eaffb1a1f6fc1fc1c01cc73c3fdf0cb2

  • SHA1

    6bc085e9b71cd8a79688f28547df8c1cde97ef2c

  • SHA256

    15963fa2085ea360f528506bd5f515d2f61bb0c456e6ca91ea814de62039ceff

  • SHA512

    69ca049498c75b683312faabcbfceb9c68af4a248c43284039e5b75e97141aba9929882ff5ef28c64dff801aef3c13297284f584853b756ba8a09bd1b18d2e2c

  • SSDEEP

    393216:j51YNP9rbT01YNP9rbTetel5qPnLFXlckK9QM8nAB3Q0GF9g9Jh6vEo56OmNm:j5grsgrWIlwPLFXTK9Q1kAZubTB8

Score
10/10
empyreannjratlimepersistencepyinstallertrojanupx

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Lime

C2

219.254.199.13:6522

Mutex

Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    KartRider

Targets

    • Target

      15963fa2085ea360f528506bd5f515d2f61bb0c456e6ca91ea814de62039ceff

    • Size

      31.4MB

    • MD5

      eaffb1a1f6fc1fc1c01cc73c3fdf0cb2

    • SHA1

      6bc085e9b71cd8a79688f28547df8c1cde97ef2c

    • SHA256

      15963fa2085ea360f528506bd5f515d2f61bb0c456e6ca91ea814de62039ceff

    • SHA512

      69ca049498c75b683312faabcbfceb9c68af4a248c43284039e5b75e97141aba9929882ff5ef28c64dff801aef3c13297284f584853b756ba8a09bd1b18d2e2c

    • SSDEEP

      393216:j51YNP9rbT01YNP9rbTetel5qPnLFXlckK9QM8nAB3Q0GF9g9Jh6vEo56OmNm:j5grsgrWIlwPLFXTK9Q1kAZubTB8

    Score
    10/10
    njratlimepersistencepyinstallertrojanupx

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks