Overview

overview

10

Static

static

9

8f4974c66f...18.exe

windows7-x64

10

8f4974c66f...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8f4974c66f466ada4934acf0f1f34726_JaffaCakes118

  • Size

    383KB

  • Sample

    240602-y2lpdsef55

  • MD5

    8f4974c66f466ada4934acf0f1f34726

  • SHA1

    449fe872676f8cfae5f642adef12180d25d18e85

  • SHA256

    840645180a72cc443d3f56f11be2ea714f33ec709edbaa548dd3694451aa3790

  • SHA512

    4c4053551757eb53c60aaca705aa59a7032f7a2e81094bb042a1b4b16a5c0a3adadab6fcf4368c91a33e20d536ee27cf04f75c1d1ebf11516ece1cc51d0ab274

  • SSDEEP

    3072:20C4issn9XtuCkG6ZkDQNfj21k7v5vG+9UIrDBl6GO5Fl0BzISj/+kkad3pv8GF:20CrIGLQNbZ5R9JBRO5Fl0JjJLVag

Score
10/10
njratnyan cattrojan

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

asd2xxx.duckdns.org:1445

Mutex

0bcc55fde5b14a8

Attributes
  • reg_key

    0bcc55fde5b14a8

  • splitter

    @!#&^%$

Targets

    • Target

      8f4974c66f466ada4934acf0f1f34726_JaffaCakes118

    • Size

      383KB

    • MD5

      8f4974c66f466ada4934acf0f1f34726

    • SHA1

      449fe872676f8cfae5f642adef12180d25d18e85

    • SHA256

      840645180a72cc443d3f56f11be2ea714f33ec709edbaa548dd3694451aa3790

    • SHA512

      4c4053551757eb53c60aaca705aa59a7032f7a2e81094bb042a1b4b16a5c0a3adadab6fcf4368c91a33e20d536ee27cf04f75c1d1ebf11516ece1cc51d0ab274

    • SSDEEP

      3072:20C4issn9XtuCkG6ZkDQNfj21k7v5vG+9UIrDBl6GO5Fl0BzISj/+kkad3pv8GF:20CrIGLQNbZ5R9JBRO5Fl0JjJLVag

    Score
    10/10
    njratnyan cattrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Beds Protector Packer

      Detects Beds Protector packer used to load .NET malware.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks