Overview

overview

10

Static

static

10

d422eaabc8...d7.exe

windows7-x64

10

d422eaabc8...d7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d422eaabc8ad234cbfe79ef20dbbd6386fa5a367c9da869a33cac7379830a6d7.exe

  • Size

    31KB

  • Sample

    240523-ch1hjsaa73

  • MD5

    d16886dc04d9ce85c604088c886b8fd5

  • SHA1

    49653245efb1cfe5eee9b3452bb83c6718ba5c2f

  • SHA256

    d422eaabc8ad234cbfe79ef20dbbd6386fa5a367c9da869a33cac7379830a6d7

  • SHA512

    b1bfa78a37e9e8a957c8ff4203f607e952dfa46e0ff3d22706e0d3d44c10f60a2f24f73559d63c5ad919b06b71920b79f8c6b4fad92d57ff8e49c9732f2f82fc

  • SSDEEP

    768:njMXjwpJbb2zxxO56eqvPisfv8yQmIDUu0tiWmj:ikKdisvQVkQj

Score
10/10
njratupssevasiontrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

upss

C2

4.tcp.eu.ngrok.io:17748

Mutex

406e946763c60aa214f9df290a7f9ffa

Attributes
  • reg_key

    406e946763c60aa214f9df290a7f9ffa

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target

      d422eaabc8ad234cbfe79ef20dbbd6386fa5a367c9da869a33cac7379830a6d7.exe

    • Size

      31KB

    • MD5

      d16886dc04d9ce85c604088c886b8fd5

    • SHA1

      49653245efb1cfe5eee9b3452bb83c6718ba5c2f

    • SHA256

      d422eaabc8ad234cbfe79ef20dbbd6386fa5a367c9da869a33cac7379830a6d7

    • SHA512

      b1bfa78a37e9e8a957c8ff4203f607e952dfa46e0ff3d22706e0d3d44c10f60a2f24f73559d63c5ad919b06b71920b79f8c6b4fad92d57ff8e49c9732f2f82fc

    • SSDEEP

      768:njMXjwpJbb2zxxO56eqvPisfv8yQmIDUu0tiWmj:ikKdisvQVkQj

    Score
    10/10
    njratevasiontrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks