Overview

overview

10

Static

static

10

SteamWindo...up.exe

windows7-x64

10

SteamWindo...up.exe

windows10-2004-x64

7

Sharing

Copy URL Twitter E-mail

General

  • Target

    7526b1d12937ee52dca89bfc047d1e3ac054a233644995221f90e01f6b609c1f

  • Size

    52KB

  • Sample

    240806-zclhrszdjm

  • MD5

    0824023be59b5b0bbec1de4bd615686c

  • SHA1

    bdcc5ca22f1d25e9813585d4873aa7a3fe50ba14

  • SHA256

    7526b1d12937ee52dca89bfc047d1e3ac054a233644995221f90e01f6b609c1f

  • SHA512

    e738bb7270220125d12befdd4f3ca2bca21dcab1e46509cc414b66a666ba4ce0f7bab4ab40fd3295a8b405667beddd308c397ec4f66fdffddffa0ece105aaf2d

  • SSDEEP

    768:HuYYlhRfIKXpZkFyVxvRkNZEF4M66uTUeKYAm6McWOpxKfI6GWIRuYYdKPUaYTRp:R+PfDZZPvFZ67ToYAnMLUxJMYhgT6GD

Score
10/10
njrathackeddiscoverypersistencetrojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:55658

Mutex

SteamWindowsUPDATESERVICE.exe

Attributes
  • reg_key

    SteamWindowsUPDATESERVICE.exe

  • splitter

    |Ghost|

Targets

    • Target

      SteamWindowsServiceUpdateSetup.exe

    • Size

      329KB

    • MD5

      8eb6b264c921357129923129497b50af

    • SHA1

      0cae8da62c423594915457d4958ed8fc73e08d4f

    • SHA256

      bbd0017cc075f23df97550847e3945a905da2c3ed8ca0d06dc030ed67d15a92c

    • SHA512

      eb1c12e2293cca7074948f06ac76aa7be062af5c9d0eefa83bdebc86fe90b4b875b76ad889103bcd9da40039793673e5660ec42a36469607ee838d7a10e24e8a

    • SSDEEP

      6144:9Dk9zivMI+GIIIIIIIhIIIIIIIIIIIIIIIU:9DZG

    Score
    10/10
    njrathackeddiscoverypersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks