Overview

overview

10

Static

static

10

286d91e1d2...18.exe

windows7-x64

10

286d91e1d2...18.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    286d91e1d25780b99e04edc0d880e229_JaffaCakes118
  • Size 23KB
  • Sample240509-fs92hsfb95
  • SHA256 72e6c01daffadb74c9ba7253615ff48d8877f65d6ec79feee82d089634655a5e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
njratusbevasionpersistencetrojan

Malware Config

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • usb

C2

  • 197.245.219.168:1443

Mutex

  • 5e7917ea1a0a3cedd651a89caa506dd1

Attributes
  • reg_key

    5e7917ea1a0a3cedd651a89caa506dd1

  • splitter

    |'|'|

Targets

    • Target
      286d91e1d25780b99e04edc0d880e229_JaffaCakes118
    • Size 23KB
    • SHA256 72e6c01daffadb74c9ba7253615ff48d8877f65d6ec79feee82d089634655a5e
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    njratusbevasionpersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks