Overview

overview

10

Static

static

10

Payload.exe

windows7-x64

10

Payload.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payload.exe

  • Size

    27KB

  • Sample

    241001-vg68tazgql

  • MD5

    bdf3331ec3d5b67d4a746773620c3d0a

  • SHA1

    be97cd7753b2758bc0503697ed51efaab67174b6

  • SHA256

    eb4915daeeadd59534ef61affc71891a0ba7cba989a1b72d5ad4c8065e0adb39

  • SHA512

    7bced8fd2557f950086553f06314c988ef6c4e17ff841e0b5c5161cb8bfda01db44c3fcf19e79e5453a8fb0456a39157cf8a9cb16aaeef5dc87cc863ecf41120

  • SSDEEP

    384:lLEF5aMG4AvkF0jc49+PUimiM5AQk93vmhm7UMKmIEecKdbXTzm9bVhca96mr6eW:lkUZua35A/vMHTi9bD

Score
10/10
njratwindowsdiscoverypersistencetrojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

Windows

C2

language-sublime.gl.at.ply.gg:8080

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Targets

    • Target

      Payload.exe

    • Size

      27KB

    • MD5

      bdf3331ec3d5b67d4a746773620c3d0a

    • SHA1

      be97cd7753b2758bc0503697ed51efaab67174b6

    • SHA256

      eb4915daeeadd59534ef61affc71891a0ba7cba989a1b72d5ad4c8065e0adb39

    • SHA512

      7bced8fd2557f950086553f06314c988ef6c4e17ff841e0b5c5161cb8bfda01db44c3fcf19e79e5453a8fb0456a39157cf8a9cb16aaeef5dc87cc863ecf41120

    • SSDEEP

      384:lLEF5aMG4AvkF0jc49+PUimiM5AQk93vmhm7UMKmIEecKdbXTzm9bVhca96mr6eW:lkUZua35A/vMHTi9bD

    Score
    10/10
    njratwindowsdiscoverypersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks