Overview

overview

10

Static

static

3

Bootstrapper.exe

windows7-x64

10

Bootstrapper.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Bootstrapper.exe

  • Size

    19.0MB

  • Sample

    241019-rd7hma1hnl

  • MD5

    4581b2e238f1dad629dc72c168b2be8e

  • SHA1

    74dce1860065aad35cb68115545bdf862bddb775

  • SHA256

    233f9f88c16fb185eb91f4afc116b808eb8fa5fd0cf1b3d3a92ec6732c56314b

  • SHA512

    dcea04ffffdf35107a0cd6998eaef3f91270985c80028c206f59ae7d9b193defb3089826a7d1118391f849618904fdf7e77621348531b711d2eac89f422d132a

  • SSDEEP

    24576:tigOpgzfDfMSCWk6/SCOqZkHIyGigOpgzfDfMSCWk6/SCOqZkHIy:dB5CW9/SCzhycB5CW9/SCzhy

Score
10/10
njrathackeddefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

86.1.93.186:25565
Mutex

7b8566fe52762c19d1b844b254fc8d30

Attributes
  • reg_key

    7b8566fe52762c19d1b844b254fc8d30

  • splitter

    |'|'|

Targets

    • Target

      Bootstrapper.exe

    • Size

      19.0MB

    • MD5

      4581b2e238f1dad629dc72c168b2be8e

    • SHA1

      74dce1860065aad35cb68115545bdf862bddb775

    • SHA256

      233f9f88c16fb185eb91f4afc116b808eb8fa5fd0cf1b3d3a92ec6732c56314b

    • SHA512

      dcea04ffffdf35107a0cd6998eaef3f91270985c80028c206f59ae7d9b193defb3089826a7d1118391f849618904fdf7e77621348531b711d2eac89f422d132a

    • SSDEEP

      24576:tigOpgzfDfMSCWk6/SCOqZkHIyGigOpgzfDfMSCWk6/SCOqZkHIy:dB5CW9/SCzhycB5CW9/SCzhy

    Score
    10/10
    njrathackeddefense_evasiondiscoveryevasionpersistenceprivilege_escalationtrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Blocklisted process makes network request

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Command and Scripting Interpreter

1
T1059

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Obfuscated Files or Information

1
T1027

Command Obfuscation

1
T1027.010

Credential Access

Discovery

Peripheral Device Discovery

1
T1120

Query Registry

2
T1012

System Information Discovery

4
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Tasks