Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    2fb7fc0949aa14070e5e5d1ec37d48e7.exe

  • Size

    65KB

  • Sample

    240405-vydylahh4w

  • MD5

    2fb7fc0949aa14070e5e5d1ec37d48e7

  • SHA1

    9b0043790d9881f690e11086004d3218648d9c22

  • SHA256

    246ab25a7240d684c1a6bf5abd6bcd6f13e0d86c97940883bc249e2b7cb23853

  • SHA512

    13a475df0962a72f8c817511dbda22efb07c41167ebac229c7b0193a88c0f6bf383025e1327732b152d8a53ab4358d4b40d3c6f4b09cc3881165bda826e16f3b

  • SSDEEP

    1536:FIkoUoN36tSQviFw1gnRuBnvbLfLteF3nLrB9z3nNaF9bIS9vM:FIkoUoN36tSQviFC08BnHfWl9zdaF9bw

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:11964

Mutex

Exspa.exe

Attributes
  • reg_key

    Exspa.exe

  • splitter

    |Ghost|

Targets

    • Target

      2fb7fc0949aa14070e5e5d1ec37d48e7.exe

    • Size

      65KB

    • MD5

      2fb7fc0949aa14070e5e5d1ec37d48e7

    • SHA1

      9b0043790d9881f690e11086004d3218648d9c22

    • SHA256

      246ab25a7240d684c1a6bf5abd6bcd6f13e0d86c97940883bc249e2b7cb23853

    • SHA512

      13a475df0962a72f8c817511dbda22efb07c41167ebac229c7b0193a88c0f6bf383025e1327732b152d8a53ab4358d4b40d3c6f4b09cc3881165bda826e16f3b

    • SSDEEP

      1536:FIkoUoN36tSQviFw1gnRuBnvbLfLteF3nLrB9z3nNaF9bIS9vM:FIkoUoN36tSQviFC08BnHfWl9zdaF9bw

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks