Overview

overview

10

Static

static

10

javasfsdtg...2).exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    javasfsdtgkoratg (2).exe

  • Size

    43KB

  • Sample

    241020-vyaaeazgma

  • MD5

    75f876f184505cc110923210adf581cc

  • SHA1

    2670bf9724001fd9ba1370682c8deddb22d1a35c

  • SHA256

    18d57def8a8508e9767383a47b26a31d30b4ed1d4fadc260d61810f32ea14a13

  • SHA512

    345c6cbeba7d3db55dee9a4717dea12b32693b19f8588920e2841330ba821fe0fb85769c26cb4b3050d1f851b3bfd26ea14b3dae24be095658243141ae151f74

  • SSDEEP

    384:GZy8tFgpWfxyiihvhAhjEhHSLizYIij+ZsNO3PlpJKkkjh/TzF7pWnD/greT0pqD:c7tWofYiYhcYy4uXQ/oO/+L

Score
10/10
njratassaultdiscoverypersistencetrojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

assault

C2

pro-fundraising.gl.at.ply.gg:43768

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      javasfsdtgkoratg (2).exe

    • Size

      43KB

    • MD5

      75f876f184505cc110923210adf581cc

    • SHA1

      2670bf9724001fd9ba1370682c8deddb22d1a35c

    • SHA256

      18d57def8a8508e9767383a47b26a31d30b4ed1d4fadc260d61810f32ea14a13

    • SHA512

      345c6cbeba7d3db55dee9a4717dea12b32693b19f8588920e2841330ba821fe0fb85769c26cb4b3050d1f851b3bfd26ea14b3dae24be095658243141ae151f74

    • SSDEEP

      384:GZy8tFgpWfxyiihvhAhjEhHSLizYIij+ZsNO3PlpJKkkjh/TzF7pWnD/greT0pqD:c7tWofYiYhcYy4uXQ/oO/+L

    Score
    10/10
    njratassaultdiscoverypersistencetrojan

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks