Overview

overview

10

Static

static

1

ed416660fa...18.exe

windows7-x64

10

ed416660fa...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ed416660fae2fd394b4fb86734ee2537_JaffaCakes118

  • Size

    215KB

  • Sample

    240920-kx6xwayclf

  • MD5

    ed416660fae2fd394b4fb86734ee2537

  • SHA1

    a6c119373e247b1c326722b1664d11e992e0193b

  • SHA256

    204a6ad18e7d11b76bcdfa0ef2e28d13c785417e99185041725e9aa92b17d470

  • SHA512

    71208a460053c01bfac5c37b8fee557fb19a58a75f646c51a54c3a84c2b64bdcfed56469518fc42e7626b495a5b5462d08d192a7fa858a3bd7817df6c1307d4f

  • SSDEEP

    3072:NJ3HYYbFGMBLbJXJoWayyQR/H28yApPWggZ4/RZGBOPxSn:NBH5F3P1n/H1WgKT

Score
10/10
njrathackedevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

facbook.no-ip.org:83

Mutex

425e6c71c1cb23180918f788a9a47454

Attributes
  • reg_key

    425e6c71c1cb23180918f788a9a47454

  • splitter

    |'|'|

Targets

    • Target

      ed416660fae2fd394b4fb86734ee2537_JaffaCakes118

    • Size

      215KB

    • MD5

      ed416660fae2fd394b4fb86734ee2537

    • SHA1

      a6c119373e247b1c326722b1664d11e992e0193b

    • SHA256

      204a6ad18e7d11b76bcdfa0ef2e28d13c785417e99185041725e9aa92b17d470

    • SHA512

      71208a460053c01bfac5c37b8fee557fb19a58a75f646c51a54c3a84c2b64bdcfed56469518fc42e7626b495a5b5462d08d192a7fa858a3bd7817df6c1307d4f

    • SSDEEP

      3072:NJ3HYYbFGMBLbJXJoWayyQR/H28yApPWggZ4/RZGBOPxSn:NBH5F3P1n/H1WgKT

    Score
    10/10
    njrathackedevasionpersistenceprivilege_escalationtrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks