Overview

overview

10

Static

static

10

3477c51b4d...98.exe

windows7-x64

10

3477c51b4d...98.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    3477c51b4db8004874eeb950fced5e89d636b4ad123595ca403f8fca5c430498.exe

  • Size

    93KB

  • Sample

    240428-blj5ascf77

  • MD5

    59bc430c7e94eda88ba59fc1fa3d2c0c

  • SHA1

    7af6f4bd5d7c38ad87432785344f3016e873b151

  • SHA256

    3477c51b4db8004874eeb950fced5e89d636b4ad123595ca403f8fca5c430498

  • SHA512

    578f3b0c79a83bf85ed945dd6ff8e3f6469ce40bfbf7058849f6901a64e12719c73a98fedb3d877ac9b8e7a4fb1aa72186431f7ad933c1e705d6298d33ff2b07

  • SSDEEP

    768:8Y3Jwmm6h1ychQVHwUM7k+rhHX9/NhUQBi0yXxrjEtCdnl2pi1Rz4Rk39sGdpTgM:Nw76rCHwB4+r9ptcjEwzGi1dDtDTgS

Score
10/10
njrathackedevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

7.tcp.eu.ngrok.io:10250
Mutex

bd45e682ad8a06dcb9168f1be41d3129

Attributes
  • reg_key

    bd45e682ad8a06dcb9168f1be41d3129

  • splitter

    |'|'|

Targets

    • Target

      3477c51b4db8004874eeb950fced5e89d636b4ad123595ca403f8fca5c430498.exe

    • Size

      93KB

    • MD5

      59bc430c7e94eda88ba59fc1fa3d2c0c

    • SHA1

      7af6f4bd5d7c38ad87432785344f3016e873b151

    • SHA256

      3477c51b4db8004874eeb950fced5e89d636b4ad123595ca403f8fca5c430498

    • SHA512

      578f3b0c79a83bf85ed945dd6ff8e3f6469ce40bfbf7058849f6901a64e12719c73a98fedb3d877ac9b8e7a4fb1aa72186431f7ad933c1e705d6298d33ff2b07

    • SSDEEP

      768:8Y3Jwmm6h1ychQVHwUM7k+rhHX9/NhUQBi0yXxrjEtCdnl2pi1Rz4Rk39sGdpTgM:Nw76rCHwB4+r9ptcjEwzGi1dDtDTgS

    Score
    10/10
    njrathackedevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks