Overview

overview

10

Static

static

10

Server.exe

windows7-x64

10

Server.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Server.exe

  • Size

    37KB

  • Sample

    240417-jd6bkaae4z

  • MD5

    de43783b8b13388eb629c7675983def1

  • SHA1

    9d8285f25c0e8d2a16fae6cba5d5dfbcf2c1d1f7

  • SHA256

    0837d32cd4aabde333efdfc2695f522c07e505131b3d36cc12618be91a057290

  • SHA512

    1052d7f2a2efb7543b970278f11e0b71410386fb7f8b1322ec14ec5681caf114e4f5ef2e30e1d3975207406559595a51d0e3c496de35a9bef6a3b58a6ca32a43

  • SSDEEP

    384:SgzZxj6ic7ri5Z7JAyk/Y4IvDfZeKQVerAF+rMRTyN/0L+EcoinblneHQM3epzXl:RznHJ7k/Y4IDZbQorM+rMRa8NuTht

Score
10/10
njrathackedevasiontrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

require-spa.gl.at.ply.gg:29750

Mutex

22a96a36e708412bc80ea4f11f20f4c1

Attributes
  • reg_key

    22a96a36e708412bc80ea4f11f20f4c1

  • splitter

    |'|'|

Targets

    • Target

      Server.exe

    • Size

      37KB

    • MD5

      de43783b8b13388eb629c7675983def1

    • SHA1

      9d8285f25c0e8d2a16fae6cba5d5dfbcf2c1d1f7

    • SHA256

      0837d32cd4aabde333efdfc2695f522c07e505131b3d36cc12618be91a057290

    • SHA512

      1052d7f2a2efb7543b970278f11e0b71410386fb7f8b1322ec14ec5681caf114e4f5ef2e30e1d3975207406559595a51d0e3c496de35a9bef6a3b58a6ca32a43

    • SSDEEP

      384:SgzZxj6ic7ri5Z7JAyk/Y4IvDfZeKQVerAF+rMRTyN/0L+EcoinblneHQM3epzXl:RznHJ7k/Y4IDZbQorM+rMRa8NuTht

    Score
    10/10
    njrathackedevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks