Overview

overview

10

Static

static

10

68264570c8...ab.exe

windows7-x64

10

68264570c8...ab.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    68264570c80f8dc735340ff74d4cba38f982bbea7c83796a43a76a212030c4ab

  • Size

    301KB

  • Sample

    240419-2d5zxaaa7v

  • MD5

    157aebace0ee68d1f0d733d68eb23dfd

  • SHA1

    5eeb4fc1e5b60234236a8c202284bc93a2d413e3

  • SHA256

    68264570c80f8dc735340ff74d4cba38f982bbea7c83796a43a76a212030c4ab

  • SHA512

    a9b4bf292839f0dd329f4fcedcf8cdd3633902293881c0250e056771f2cec3791d31a6ef1858abe44eabf9b5d42b565b3c049b01c61c22defdb07801218af846

  • SSDEEP

    1536:+OjjTYLtkEW/+gRJN3izvZQye1iG5r8WA3gAIZI+GQH7K/FsUEyVOCA7b3ASlAGK:+Oj3YL2p+yJQzvq4Pqk5

Score
10/10
njratchpockevasiontrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

chpock

C2

5.39.43.50:1488

Mutex

69d141429efef10ba7775b208b9aee0b

Attributes
  • reg_key

    69d141429efef10ba7775b208b9aee0b

  • splitter

    |'|'|

Targets

    • Target

      68264570c80f8dc735340ff74d4cba38f982bbea7c83796a43a76a212030c4ab

    • Size

      301KB

    • MD5

      157aebace0ee68d1f0d733d68eb23dfd

    • SHA1

      5eeb4fc1e5b60234236a8c202284bc93a2d413e3

    • SHA256

      68264570c80f8dc735340ff74d4cba38f982bbea7c83796a43a76a212030c4ab

    • SHA512

      a9b4bf292839f0dd329f4fcedcf8cdd3633902293881c0250e056771f2cec3791d31a6ef1858abe44eabf9b5d42b565b3c049b01c61c22defdb07801218af846

    • SSDEEP

      1536:+OjjTYLtkEW/+gRJN3izvZQye1iG5r8WA3gAIZI+GQH7K/FsUEyVOCA7b3ASlAGK:+Oj3YL2p+yJQzvq4Pqk5

    Score
    10/10
    njratchpockevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks