Overview

overview

10

Static

static

3

51e086e218...7N.exe

windows7-x64

10

51e086e218...7N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    51e086e218287597e08cf44b4c23bf76a7d46bf617497bd169ef3ca3f03fcc77N

  • Size

    123KB

  • Sample

    240927-ql23fathrj

  • MD5

    a5bafcc2a638d9b17dcea7740d638840

  • SHA1

    cc6429de83fd822954d61fc210879e16bc403607

  • SHA256

    51e086e218287597e08cf44b4c23bf76a7d46bf617497bd169ef3ca3f03fcc77

  • SHA512

    102ff016a32f7f29f78c936cc65ca242de812b81d417145b216ccc68b8eecb06397bec9086f40f492523f9d77b548fff99fa940ab791e9054c9576e54c56cf5c

  • SSDEEP

    1536:ZRPmllKuBPVRs9zhIiEL7UQ0UCjW8uD/NXPV8yUYZ8DZB4Se2uqswB0:LUBPTIhtELIQ0Ux5p/Vdxyj/W

Score
10/10
njrathackedevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

thought-playback.gl.at.ply.gg:27987

Mutex

25797a04c7e8633fb03692e2c4d25fbe

Attributes
  • reg_key

    25797a04c7e8633fb03692e2c4d25fbe

  • splitter

    |'|'|

Targets

    • Target

      51e086e218287597e08cf44b4c23bf76a7d46bf617497bd169ef3ca3f03fcc77N

    • Size

      123KB

    • MD5

      a5bafcc2a638d9b17dcea7740d638840

    • SHA1

      cc6429de83fd822954d61fc210879e16bc403607

    • SHA256

      51e086e218287597e08cf44b4c23bf76a7d46bf617497bd169ef3ca3f03fcc77

    • SHA512

      102ff016a32f7f29f78c936cc65ca242de812b81d417145b216ccc68b8eecb06397bec9086f40f492523f9d77b548fff99fa940ab791e9054c9576e54c56cf5c

    • SSDEEP

      1536:ZRPmllKuBPVRs9zhIiEL7UQ0UCjW8uD/NXPV8yUYZ8DZB4Se2uqswB0:LUBPTIhtELIQ0Ux5p/Vdxyj/W

    Score
    10/10
    njrathackedevasionpersistenceprivilege_escalationtrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks