Overview

overview

10

Static

static

3

518f22ac3d...18.exe

windows7-x64

10

518f22ac3d...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cc282f5c2ff88929a1190177ced0ee50abf25e04228663ff4a6576922a928f1d

  • Size

    325KB

  • Sample

    240417-rplqasdb4y

  • MD5

    ea315c1aab3a05cb02a4d0f7b1aa8f95

  • SHA1

    b01514144d26c24f59951c3178e6e07e8b51a655

  • SHA256

    cc282f5c2ff88929a1190177ced0ee50abf25e04228663ff4a6576922a928f1d

  • SHA512

    d16018403805a25d2ccc69e579a3d8f1108f041dfd8606a2ce129cccb5bfc94b7277b8d2fe101c6a2cb2bcb751b9ae63eccb54a69f98959246b618c8540a58d7

  • SSDEEP

    6144:eDCnsMi9EtG4mGsylVJLr3J5tzjlqlBG1Dz75y5ukLDSIm6xTBjE:zn69FNGnlVtr3J5hDhVKu+DpbM

Score
10/10
44calibernjrathackedevasionpersistencespywarestealertrojan

Malware Config

Extracted

Family

44caliber

C2

https://discord.com/api/webhooks/1199323175729758268/CBdP8e3cXbL0ED8xKBhMw0ikKHmITu-6CI4WjfttZm2aWGZGjp43Msrjwp8AVeEBf6T1

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

mary-cottage.gl.at.ply.gg:10652

Mutex

9902b29d6de7130c2f409ab27fb09fa7

Attributes
  • reg_key

    9902b29d6de7130c2f409ab27fb09fa7

  • splitter

    |'|'|

Targets

    • Target

      518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818.exe

    • Size

      460KB

    • MD5

      3e5ba25aa4f23ceb11be209d1967e341

    • SHA1

      c25a05acb5231776456d08fad7df0e48d92931c0

    • SHA256

      518f22ac3dfb39779d6b21fdd230b71db39453f73b42f411009a0afe7dbbe818

    • SHA512

      184243d51766bf8d292308e0177046f88e0eb55201eddc9d14670dd3d526c5ed6026c03c88227698670f451f43a3e4f1378f51f2334a9b54d83bb2bc677b0c04

    • SSDEEP

      6144:jE+yclwQKjdn+WPtYVJIoBfRT+tkbOSeC2xDjAzQeOOg7Y55HkVSGsc:jBdlwHRn+WlYV+8T+tkKC0EEE17HkV8c

    Score
    10/10
    44calibernjrathackedevasionpersistencespywarestealertrojan

    • 44Caliber

      An open source infostealer written in C#.

      stealer44caliber

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Accesses cryptocurrency files/wallets, possible credential harvesting

      spyware

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Unsecured Credentials

2
T1552

Credentials In Files

2
T1552.001

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks