Overview

overview

10

Static

static

3

8760a9a669...6a.exe

windows7-x64

10

8760a9a669...6a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8760a9a669f5c298dbb04ff38fe8bfa72036fd093c8f5f2ee137ae02703c216a

  • Size

    59KB

  • Sample

    241019-ah6nfsxfjj

  • MD5

    b605dd61f05028f5f48fbc2c8170273e

  • SHA1

    9e452f6adfefc5e07d5f6800137fa3f2ae7156b5

  • SHA256

    8760a9a669f5c298dbb04ff38fe8bfa72036fd093c8f5f2ee137ae02703c216a

  • SHA512

    c12da2b928dad93eb2d6d614f216f33f7baf0dcb83ec6ec13df1dc9db2466f98b1d14bce361941d9a179e9f4028171e660f6b8f4ba13358ba3b442aac5de79b4

  • SSDEEP

    1536:t00NjIXChbP8Nm82Uuw5tnvvyTC7mVcl:60S2bPwmRw5ZOC78Y

Score
10/10
njratmohibevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

mohib

C2

127.0.0.1:1978

Mutex

a0b72362103f09d1b009d939c194f0ce

Attributes
  • reg_key

    a0b72362103f09d1b009d939c194f0ce

  • splitter

    |'|'|

Targets

    • Target

      8760a9a669f5c298dbb04ff38fe8bfa72036fd093c8f5f2ee137ae02703c216a

    • Size

      59KB

    • MD5

      b605dd61f05028f5f48fbc2c8170273e

    • SHA1

      9e452f6adfefc5e07d5f6800137fa3f2ae7156b5

    • SHA256

      8760a9a669f5c298dbb04ff38fe8bfa72036fd093c8f5f2ee137ae02703c216a

    • SHA512

      c12da2b928dad93eb2d6d614f216f33f7baf0dcb83ec6ec13df1dc9db2466f98b1d14bce361941d9a179e9f4028171e660f6b8f4ba13358ba3b442aac5de79b4

    • SSDEEP

      1536:t00NjIXChbP8Nm82Uuw5tnvvyTC7mVcl:60S2bPwmRw5ZOC78Y

    Score
    10/10
    njratmohibevasionpersistenceprivilege_escalationtrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks