Overview

overview

10

Static

static

10

634a5e24ed...cd.exe

windows7-x64

10

634a5e24ed...cd.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    634a5e24eda00b716c30b8c463f811a3d0d413a8e0e1e02b1bb2518be225ddcd.exe

  • Size

    37KB

  • Sample

    240928-jyzphsxfkh

  • MD5

    5e16a3eac79835659433ec179b8ed4ef

  • SHA1

    32767a796ce2d207df6f6a6b70bf58da4e3dac19

  • SHA256

    634a5e24eda00b716c30b8c463f811a3d0d413a8e0e1e02b1bb2518be225ddcd

  • SHA512

    37be7905e591f050fb442ede75bcb451e504744bee9b58e6d21d9a3ba6b509d2ea4d3fa107645ff5ef7a6cdd53d900f42c404d2146491d4446d2f728228f33f9

  • SSDEEP

    384:7D1qiU954NLHdayszXlKvhbsmmk8rAF+rMRTyN/0L+EcoinblneHQM3epzXlNrnz:XXZdJszXlKxFmZrM+rMRa8Nuzvt

Score
10/10
njrathacked pubgdiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed PUBG

C2

cantburn.hopto.org:1177

Mutex

7b5444a8f8ca9a359aadb891c7e9f01b

Attributes
  • reg_key

    7b5444a8f8ca9a359aadb891c7e9f01b

  • splitter

    |'|'|

Targets

    • Target

      634a5e24eda00b716c30b8c463f811a3d0d413a8e0e1e02b1bb2518be225ddcd.exe

    • Size

      37KB

    • MD5

      5e16a3eac79835659433ec179b8ed4ef

    • SHA1

      32767a796ce2d207df6f6a6b70bf58da4e3dac19

    • SHA256

      634a5e24eda00b716c30b8c463f811a3d0d413a8e0e1e02b1bb2518be225ddcd

    • SHA512

      37be7905e591f050fb442ede75bcb451e504744bee9b58e6d21d9a3ba6b509d2ea4d3fa107645ff5ef7a6cdd53d900f42c404d2146491d4446d2f728228f33f9

    • SSDEEP

      384:7D1qiU954NLHdayszXlKvhbsmmk8rAF+rMRTyN/0L+EcoinblneHQM3epzXlNrnz:XXZdJszXlKxFmZrM+rMRa8Nuzvt

    Score
    10/10
    njrathacked pubgdiscoveryevasionpersistenceprivilege_escalationtrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.