Overview

overview

10

Static

static

10

248ef28ddf...d6.exe

windows7-x64

10

248ef28ddf...d6.exe

windows10-2004-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target

    248ef28ddf2c7907ebac2c3bdd1d8f79a4f6bfb430ea87cc857d2187b6bfc4d6

  • Size

    37KB

  • Sample

    240810-vnh5kayfpk

  • MD5

    cb09a75beae0520f594a08df186d8d1d

  • SHA1

    15f0d56be40b56350c7c91b5afff1ec33616ef26

  • SHA256

    248ef28ddf2c7907ebac2c3bdd1d8f79a4f6bfb430ea87cc857d2187b6bfc4d6

  • SHA512

    acc50e4dc005e94acc97e1f9fb3929ad8d6956c0d951e487538031c2c5d282f93a6ed70d4bf1b0eacce671489e9675843a49412a4f757107e116aee91cb51e1b

  • SSDEEP

    384:HLyvEiTb7vpWNcwIyKrtaW/1TOOv2UthrAF+rMRTyN/0L+EcoinblneHQM3epzXK:ryjTwjKr8+oOeUXrM+rMRa8NuTct

Score
10/10
njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

193.32.248.218:443

Mutex

321802fd71ac55feb1ecf54b190e0a8f

Attributes
  • reg_key

    321802fd71ac55feb1ecf54b190e0a8f

  • splitter

    |'|'|

Targets

    • Target

      248ef28ddf2c7907ebac2c3bdd1d8f79a4f6bfb430ea87cc857d2187b6bfc4d6

    • Size

      37KB

    • MD5

      cb09a75beae0520f594a08df186d8d1d

    • SHA1

      15f0d56be40b56350c7c91b5afff1ec33616ef26

    • SHA256

      248ef28ddf2c7907ebac2c3bdd1d8f79a4f6bfb430ea87cc857d2187b6bfc4d6

    • SHA512

      acc50e4dc005e94acc97e1f9fb3929ad8d6956c0d951e487538031c2c5d282f93a6ed70d4bf1b0eacce671489e9675843a49412a4f757107e116aee91cb51e1b

    • SSDEEP

      384:HLyvEiTb7vpWNcwIyKrtaW/1TOOv2UthrAF+rMRTyN/0L+EcoinblneHQM3epzXK:ryjTwjKr8+oOeUXrM+rMRa8NuTct

    Score
    10/10
    njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Tasks