Overview

overview

10

Static

static

10

c759c29a0b...92.exe

windows7-x64

10

c759c29a0b...92.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c759c29a0b88245c13e850d83e727292

  • Size

    432KB

  • Sample

    240314-bz98mshf37

  • MD5

    c759c29a0b88245c13e850d83e727292

  • SHA1

    bc7698f335048351e3990f58aca011ac5e91588c

  • SHA256

    e5ea256c56ad2fdb898bd56297a0b20b213ac4018eb060750d3ed5359d76a4c1

  • SHA512

    e5ab76459ff9a074f769ccbd1488a23a8273bc326e1851eb5f41b9fe72279fd1449edc0c9bec84de7d9822d772b8c8fe278d1ee759c204be83c02465a6dcd560

  • SSDEEP

    6144:ExvZdXMV2vr0Mw3RADz/LLsRGHTodi4ZtYJQiXYanRzTY26WlEFXP2ALsEqmVgZg:WMVw0CHXskTMi4XKJXY2/AYEqFZk30bo

Score
10/10
njratzgratlimerattrojan

Malware Config

Extracted

Family

njrat

Version

0.7.3

Botnet

Lime

C2

127.0.0.1:4499

Mutex

Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    0000

Targets

    • Target

      c759c29a0b88245c13e850d83e727292

    • Size

      432KB

    • MD5

      c759c29a0b88245c13e850d83e727292

    • SHA1

      bc7698f335048351e3990f58aca011ac5e91588c

    • SHA256

      e5ea256c56ad2fdb898bd56297a0b20b213ac4018eb060750d3ed5359d76a4c1

    • SHA512

      e5ab76459ff9a074f769ccbd1488a23a8273bc326e1851eb5f41b9fe72279fd1449edc0c9bec84de7d9822d772b8c8fe278d1ee759c204be83c02465a6dcd560

    • SSDEEP

      6144:ExvZdXMV2vr0Mw3RADz/LLsRGHTodi4ZtYJQiXYanRzTY26WlEFXP2ALsEqmVgZg:WMVw0CHXskTMi4XKJXY2/AYEqFZk30bo

    Score
    10/10
    njratzgratlimerattrojan

    • Detect ZGRat V1

    • ZGRat

      ZGRat is remote access trojan written in C#.

      ratzgrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks