Overview

overview

10

Static

static

10

fotos_motel.exe

windows7-x64

10

fotos_motel.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0f3be175aa7ae9d636bc50687e697357_JaffaCakes118

  • Size

    10KB

  • Sample

    241003-r764ysthrd

  • MD5

    0f3be175aa7ae9d636bc50687e697357

  • SHA1

    31b9099c6c0fbbe509103b8194d4c19f89bfd3aa

  • SHA256

    a6a98e011ec777596c5085902810dfedef0f1afa157c112795258dab56de0940

  • SHA512

    20b0ba605c0456b3a80ed5ef815668dad3e0d8224420110907418040d48802f4deebfd03efcffb071c1a0926595d273a71f9c94fe1e63cecad66578db65652a2

  • SSDEEP

    192:lSNpGbhG7O9kdHe2e4///OJZAx4A714XNe2ZHlhTCkN+LvmeO4qgemg:I4sqIHx9/0ZAx4A7CRZHf/Irij

Score
10/10
njratpwneddiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Pwned

C2

host315.ddns.net:9922

Mutex

1b6ca0ec95b6c35b2a743fc3c0b2c0db

Attributes
  • reg_key

    1b6ca0ec95b6c35b2a743fc3c0b2c0db

  • splitter

    |'|'|

Targets

    • Target

      fotos_motel.bat

    • Size

      23KB

    • MD5

      677204a44ba4647089f651b4aef4c8b2

    • SHA1

      401cfce35cfb81ece7eefd2354a5fb0cd05bf1d2

    • SHA256

      7a559980416b5a8cb2b5197c4b449462d637f88136037fd75c3138d18fddd20a

    • SHA512

      2a2735305289e9b9baf22e1312030247c9f5e91bca606afb1ff1e9b161a19dbcb616a04c8f366e8260a75c5a84f78fe9c1b6302e9aaae1dcafe474bc25793066

    • SSDEEP

      384:t98aZYC9twBNdcvFaly2H0dbJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZSC:t1Y+sNKqNHnSdRpcnua

    Score
    10/10
    njratpwneddiscoveryevasionpersistenceprivilege_escalationtrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks