Overview

overview

10

Static

static

10

Client.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Client.exe

  • Size

    31KB

  • Sample

    240315-fbmjwsgd9v

  • MD5

    b6f63748b9e56f0c08b990e5ba6a19fd

  • SHA1

    141618833a217ee8d626b724116a2359c4b2b941

  • SHA256

    ecbce1e9ec4d4ac167cb93121399395a44fa6276536c3262f5541a5a51a35f64

  • SHA512

    9bd746a921e12988337880cdf496500c391473d6b03dd143f778c346c37cff07b3881f2b836b5a9fab3619e3bfbc8bd840a7c8001e4a26755202582313d2b00a

  • SSDEEP

    768:zNJEpBZhjzOzx5+R4s/Hu56HdAbiTinvaTQmIDUu0tis8uj:UD6uukAbiT6oQVkjj

Score
10/10
njratmybotevasionpersistencetrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

C2

127.0.0.1:6522

Mutex

d2319c4fe39ba9c40104010969686b29

Attributes
  • reg_key

    d2319c4fe39ba9c40104010969686b29

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target

      Client.exe

    • Size

      31KB

    • MD5

      b6f63748b9e56f0c08b990e5ba6a19fd

    • SHA1

      141618833a217ee8d626b724116a2359c4b2b941

    • SHA256

      ecbce1e9ec4d4ac167cb93121399395a44fa6276536c3262f5541a5a51a35f64

    • SHA512

      9bd746a921e12988337880cdf496500c391473d6b03dd143f778c346c37cff07b3881f2b836b5a9fab3619e3bfbc8bd840a7c8001e4a26755202582313d2b00a

    • SSDEEP

      768:zNJEpBZhjzOzx5+R4s/Hu56HdAbiTinvaTQmIDUu0tis8uj:UD6uukAbiT6oQVkjj

    Score
    10/10
    njratevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks