Overview

overview

10

Static

static

3

46811c1d5e...18.exe

windows7-x64

10

46811c1d5e...18.exe

windows10-2004-x64

5

Sharing

Copy URL
Twitter E-mail

General

  • Target

    46811c1d5ee6760733f363749071f92e_JaffaCakes118

  • Size

    127KB

  • Sample

    240330-2xzx1ahc23

  • MD5

    46811c1d5ee6760733f363749071f92e

  • SHA1

    2c10273e7f7b5be5b8b07c9188f07b44a450166c

  • SHA256

    15d12789262a679cbefc1b5c4df5432e0592e0b5013c484c82b3a61f524a1365

  • SHA512

    c278092003c4092ea8a5fd8037869a3c6b1ea284862e3da4389d94d2af28251e83be1946114b5d29220f6c27a115d1ff454f8b3fa13c095493a512fdfbee8c20

  • SSDEEP

    3072:vTjUek9zjP62dkHEgitptSt+X9JvGdA0U3IZ0U+bZ0tm:vejPVkEgijt4OV+U3sJm

Score
10/10
njratupdatepersistencetrojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

Update

C2

194.34.132.153:1604

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      46811c1d5ee6760733f363749071f92e_JaffaCakes118

    • Size

      127KB

    • MD5

      46811c1d5ee6760733f363749071f92e

    • SHA1

      2c10273e7f7b5be5b8b07c9188f07b44a450166c

    • SHA256

      15d12789262a679cbefc1b5c4df5432e0592e0b5013c484c82b3a61f524a1365

    • SHA512

      c278092003c4092ea8a5fd8037869a3c6b1ea284862e3da4389d94d2af28251e83be1946114b5d29220f6c27a115d1ff454f8b3fa13c095493a512fdfbee8c20

    • SSDEEP

      3072:vTjUek9zjP62dkHEgitptSt+X9JvGdA0U3IZ0U+bZ0tm:vejPVkEgijt4OV+U3sJm

    Score
    10/10
    njratupdatepersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks