Overview

overview

10

Static

static

3

aa60573d3d...04.exe

windows7-x64

10

aa60573d3d...04.exe

windows10-2004-x64

3

Sharing

Copy URL
Twitter E-mail

General

  • Target

    92e8e15f6a47952d1ffaee5fe46b2f94d14d107dd2382421e017c62e49943d50

  • Size

    305KB

  • Sample

    240417-sa5qasdb54

  • MD5

    3900c5985fe734dcfeb828c08a608506

  • SHA1

    4872a01971df737afdbde34370d14455f1312717

  • SHA256

    92e8e15f6a47952d1ffaee5fe46b2f94d14d107dd2382421e017c62e49943d50

  • SHA512

    35a942cf652be155c2f68eb910188a8bfe7ce5f1df2d32d8e442d0008979c0f1a32bc01595d641c7c75e17c132f32273b57d6404609e29924759e3cb1e51a8b3

  • SSDEEP

    6144:/2gdN8JJvk9VcX33+Ax+az5KOUAHKVkF5p3mXE85l3BC:egdNtHi33++LNlHKVM/WTlRC

Score
10/10
njrathackedevasiontrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

2.tcp.eu.ngrok.io:15020

Mutex

4e9daa30b38fc305bea41b41415459d5

Attributes
  • reg_key

    4e9daa30b38fc305bea41b41415459d5

  • splitter

    |'|'|

Targets

    • Target

      aa60573d3d1a56190858edb2df0344b9d1082f0eae840004941a1d6b30a1b804.exe

    • Size

      405KB

    • MD5

      3c3d7dcdc0c4eb7dd9db090c60867a1e

    • SHA1

      19d81e94000e24afb6f63ef7e3456a01cc884f30

    • SHA256

      aa60573d3d1a56190858edb2df0344b9d1082f0eae840004941a1d6b30a1b804

    • SHA512

      aa2b2e432539124cba4f3443f3b24fd0f9d6c5e56aadf990c44dfcebd13692e15ec72fabb10cf4f55aa0227bf159c19cc45240dda1ca95fbda36ae9d8a2d5bb6

    • SSDEEP

      6144:gxj7phR7li/HN9K2iZQbZc3Plf/muQuu3f8QsEdSGTYe0i82TFpjVvxD43y8v3nj:Su/t9KzZscMuPuP8ZEVE4FXjDX8vU8

    Score
    10/10
    njrathackedevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks