Overview

overview

10

Static

static

10

x4.exe

windows7-x64

10

x4.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ae89a0e3b406cd473712df9c32363a0871611d09b411120f07d0836e3c64e5b1

  • Size

    24KB

  • Sample

    240912-t39qdstfmc

  • MD5

    c679ed4fc3d1cd4a85498d34aaf836bc

  • SHA1

    8d08c410bc26191dabc7030d335423c351131972

  • SHA256

    ae89a0e3b406cd473712df9c32363a0871611d09b411120f07d0836e3c64e5b1

  • SHA512

    897860ef71d09e9d96c99a9b020bee9310a5ee96a15f164022a2b3d7e7cd1fb3b3ef9a12ecd44c78d099dcfc7513ccd90be53bb64cab2819fad74b88abe6f689

  • SSDEEP

    384:Mccnx1M38fvgDWlc+8ytOs4YTNF0wWPhWK0MGyws6zDX6LiQnVLhsikV2q1DegB9:QM3Gg6EyB9FooSbkynsikVJAgBSER

Score
10/10
njratvictimdiscoverypersistencetrojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

C2

limited-architect.gl.at.ply.gg:52522

Mutex

e61d751939442896523a0628facf1d34

Attributes
  • reg_key

    e61d751939442896523a0628facf1d34

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target

      x4.exe.bin

    • Size

      54KB

    • MD5

      f01403f4fc9c0727876a46568faee2a5

    • SHA1

      1323d3cd7517b50a52f774024af682decf3c3698

    • SHA256

      48f2fc5866fcc8d9c02674e7fcb6e46f82aa94ccef260a885205c537c3a3ca44

    • SHA512

      99c6fdd4aeadb54e699a2ef628b2c1e44c9bd02c031399dd9d62e1c256e974829668b0cef33c84493dc6fa83bd0ab70eabf975b89b58cdce6aa21650e2d56cef

    • SSDEEP

      768:gVXZuIZ2Eslt0g5X3SY3qZJSNDxWQG35bmaePD5Pvp2XXJdxIEpmag:gVB1Gt0g5SYSG9WQcGDYX3xIEpmag

    Score
    10/10
    njratvictimdiscoverypersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks