Overview

overview

10

Static

static

3

bca1a5ae15...57.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bca1a5ae15dcd96a52275f594fc5dd6a9727414c7a1b0fc91b09aaa306ea2d57.zip

  • Size

    40KB

  • Sample

    241005-rkmrsszana

  • MD5

    d9a91b5468a67ca954ca6a91084c69bd

  • SHA1

    8aceea2f7a42f1dbe57982a2adf8a71f4f81844c

  • SHA256

    b1fcd3eda30600436aeea23653892d86895c10901a8123ec088644a93669c52b

  • SHA512

    9c5019dc8849a1c2868a7b22f2ac6634579c9cdbdcae6147876cf890f49bfdf6ad309ba28a0e8b48a5d699b8bd759230474e5b13c45924888ba8d7284da39dae

  • SSDEEP

    768:tmf0n3qxFqR0/4Eo5+Caq9hSNQ66w2Zk7M900O0INUFuhr:Ef0n6KM6JZk7M9Q038hr

Score
10/10
njrathackeddiscoverypersistencetrojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

encrypted7745.hopto.org:1177

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      bca1a5ae15dcd96a52275f594fc5dd6a9727414c7a1b0fc91b09aaa306ea2d57.exe

    • Size

      153KB

    • MD5

      bb0d5dce45941d78a9bbbbdbf900d29b

    • SHA1

      afc462d25dc8ec7c7604da71525ef9356b0e8d3e

    • SHA256

      bca1a5ae15dcd96a52275f594fc5dd6a9727414c7a1b0fc91b09aaa306ea2d57

    • SHA512

      8c8e76a38598be099369eea8d6f1b2c84b1b84388685bf4c5860ca54c6e58343bcbc189d567786a0c05290fe3feddeeacc8d096eac0ed46986b9b9ae366a4f03

    • SSDEEP

      3072:d1st4ySHIcCmLvrmVgf43Ks1Vl9ExD+Ze:Tst4FLvrmVS4JL

    Score
    10/10
    njrathackeddiscoverypersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Drops startup file

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks