Overview

overview

10

Static

static

1

d60597ac83...18.exe

windows7-x64

10

d60597ac83...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d60597ac83665d38ff02101b76c11624_JaffaCakes118

  • Size

    216KB

  • Sample

    240909-k8wahs1bqr

  • MD5

    d60597ac83665d38ff02101b76c11624

  • SHA1

    dff92f02ab5bfd33b28132dcbb175d66996a8853

  • SHA256

    11a67a4a5933c4a9ada4481541c48bb6d209f4a717a3585d6dfca539473e9cd9

  • SHA512

    f780af658f63d1a9dc640afa1ac19aaca38c107f54beaabc91834db99d2e2cecbfb04f7d17dda85c5cbb85b36dda7638777f6fca50a7021a6dc9ba92b04211fa

  • SSDEEP

    3072:PduRDpRJcoOWW/8D1lNgg21Vv2xN+g21c3Mjq9S:9i/Ngg215+N+g21xOS

Score
10/10
njratsamerevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

Samer

C2

31.9.48.183:5552

Mutex

c53540ff66b09720dee7c75eaabd8f52

Attributes
  • reg_key

    c53540ff66b09720dee7c75eaabd8f52

  • splitter

    |'|'|

Targets

    • Target

      d60597ac83665d38ff02101b76c11624_JaffaCakes118

    • Size

      216KB

    • MD5

      d60597ac83665d38ff02101b76c11624

    • SHA1

      dff92f02ab5bfd33b28132dcbb175d66996a8853

    • SHA256

      11a67a4a5933c4a9ada4481541c48bb6d209f4a717a3585d6dfca539473e9cd9

    • SHA512

      f780af658f63d1a9dc640afa1ac19aaca38c107f54beaabc91834db99d2e2cecbfb04f7d17dda85c5cbb85b36dda7638777f6fca50a7021a6dc9ba92b04211fa

    • SSDEEP

      3072:PduRDpRJcoOWW/8D1lNgg21Vv2xN+g21c3Mjq9S:9i/Ngg215+N+g21xOS

    Score
    10/10
    njratsamerevasionpersistenceprivilege_escalationtrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks