Overview

overview

10

Static

static

10

ae9ba2145b...b0.exe

windows7-x64

10

ae9ba2145b...b0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ae9ba2145b99bca3d87d444a47246a5bcd426993c74733faf4892d20e195d6b0.exe

  • Size

    23KB

  • Sample

    240927-rbf8naybnb

  • MD5

    5df583ec3d0da73461aa193c2aea4d23

  • SHA1

    1841a11cb50fa14470a98a469547ee9169df1caf

  • SHA256

    ae9ba2145b99bca3d87d444a47246a5bcd426993c74733faf4892d20e195d6b0

  • SHA512

    f8f7defd5348380905ab2e3906b671a46506eda7909514bf6b10a3c541b5f35e4e0d5c6563c82f972125b79d6f079218d1870d3880dcad0f4ec82a2a5cf505b6

  • SSDEEP

    384:nUn+E+NGW9JQFOp8AliM6vbS1puwJViz6RvlVUPVsWGsK5f9D:xGGKW6vbUpuY2cF

Score
10/10
njratnewdiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

NEW

C2

sharrych.ddns.net:5556

Mutex

723520b640cb39476dbbd3d566c664da

Attributes
  • reg_key

    723520b640cb39476dbbd3d566c664da

  • splitter

    |'|'|

Targets

    • Target

      ae9ba2145b99bca3d87d444a47246a5bcd426993c74733faf4892d20e195d6b0.exe

    • Size

      23KB

    • MD5

      5df583ec3d0da73461aa193c2aea4d23

    • SHA1

      1841a11cb50fa14470a98a469547ee9169df1caf

    • SHA256

      ae9ba2145b99bca3d87d444a47246a5bcd426993c74733faf4892d20e195d6b0

    • SHA512

      f8f7defd5348380905ab2e3906b671a46506eda7909514bf6b10a3c541b5f35e4e0d5c6563c82f972125b79d6f079218d1870d3880dcad0f4ec82a2a5cf505b6

    • SSDEEP

      384:nUn+E+NGW9JQFOp8AliM6vbS1puwJViz6RvlVUPVsWGsK5f9D:xGGKW6vbUpuY2cF

    Score
    10/10
    njratnewdiscoveryevasionpersistenceprivilege_escalationtrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks