Overview

overview

10

Static

static

3

d7ac4f4640...18.exe

windows7-x64

10

d7ac4f4640...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d7ac4f4640433ea8dc43e60badc8632e_JaffaCakes118

  • Size

    186KB

  • Sample

    240910-glg8layhmm

  • MD5

    d7ac4f4640433ea8dc43e60badc8632e

  • SHA1

    2c4a9cb374a00a030499205d415df1b2ef5e7bdf

  • SHA256

    279ee4c97a04e451b81b19335468440fc1c51bf36d13145f72673117383615b4

  • SHA512

    e0fea29ab2cf2e32aa103c2f356a0796d800c2fa3cebfe601a15660b5492f5013523926246d72ff542f62e7dc98c0dc97b4be89ae221aeb691413671381ba6e6

  • SSDEEP

    3072:ECVtOsDF/M6J8XbQG5WomjbLp+w1VXaq34uKbhgKZ2WmOmN7GrR5Kq1vaOfIZ:TzDqL0dgkQSKbGKLOcf/a

Score
10/10
njratlol1999discoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

LOL1999

C2

windowold.zapto.org:1177

Mutex

5fa67d77995c7ce7613f64282dca3b93

Attributes
  • reg_key

    5fa67d77995c7ce7613f64282dca3b93

  • splitter

    |'|'|

Targets

    • Target

      d7ac4f4640433ea8dc43e60badc8632e_JaffaCakes118

    • Size

      186KB

    • MD5

      d7ac4f4640433ea8dc43e60badc8632e

    • SHA1

      2c4a9cb374a00a030499205d415df1b2ef5e7bdf

    • SHA256

      279ee4c97a04e451b81b19335468440fc1c51bf36d13145f72673117383615b4

    • SHA512

      e0fea29ab2cf2e32aa103c2f356a0796d800c2fa3cebfe601a15660b5492f5013523926246d72ff542f62e7dc98c0dc97b4be89ae221aeb691413671381ba6e6

    • SSDEEP

      3072:ECVtOsDF/M6J8XbQG5WomjbLp+w1VXaq34uKbhgKZ2WmOmN7GrR5Kq1vaOfIZ:TzDqL0dgkQSKbGKLOcf/a

    Score
    10/10
    njratlol1999discoveryevasionpersistenceprivilege_escalationtrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks