Overview

overview

10

Static

static

3

gpuz.exe

windows7-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    gpuz.exe
  • Size 7.2MB
  • Sample240513-t8htvsfc54
  • SHA256 e61a693a6cf67be76960f969f9f6993f7aea37281cddd7dcf5df2ef745b72936
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
njratrealtek driver managerevasionpersistencetrojanupx

Malware Config

Extracted

Family

  • njrat

Version

  • im523

Botnet

  • Realtek Driver Manager

C2

  • 188.116.145.233:8000

Mutex

  • 20bf203a0f92d58bf4a3f26fbcb29e71

Attributes
  • reg_key

    20bf203a0f92d58bf4a3f26fbcb29e71

  • splitter

    |'|'|

Targets

    • Target
      gpuz.exe
    • Size 7.2MB
    • SHA256 e61a693a6cf67be76960f969f9f6993f7aea37281cddd7dcf5df2ef745b72936
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    njratrealtek driver managerevasionpersistencetrojanupx

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks