Overview

overview

10

Static

static

3

Apb.exe

windows7-x64

10

Apb.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    8e15f4de5d88adf804b9f6d99867e802_JaffaCakes118

  • Size

    177KB

  • Sample

    241103-3rrvwaxja1

  • MD5

    8e15f4de5d88adf804b9f6d99867e802

  • SHA1

    b72e4ad25e9810b519e0405be55b117fb59bb7ca

  • SHA256

    7e8890718f9870330da3f41b7ba683672eec490658616bbe85c40272d0cb61d6

  • SHA512

    6791aa5f9f7a8ace78e8734a6f467d57431cc728b10fd28d017e45bb0c4428a405033170ca6488f4ecd0df04a349ecdbbe99f8ae398e790ce496b1a550712ead

  • SSDEEP

    3072:aM+6nzVx1VuhG+RNbLw9zFj18WVUU0i/GfXXPKpoLNdvrxN72NBk8xcvTQvUfZVP:Z+6Rx1VM5LipjPz0iyXXPKpydzf2NBk7

Score
10/10
njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

sina132.no-ip.biz:5552

Mutex

657fce770b32d2b3a4cf7623dcfe841f

Attributes
  • reg_key

    657fce770b32d2b3a4cf7623dcfe841f

  • splitter

    |'|'|

Targets

    • Target

      Apb.exe

    • Size

      317KB

    • MD5

      34ba426af267b9963cd5e8766b733472

    • SHA1

      abf47a7cd5c5e16ff14592320e2f74d0ac1f06c4

    • SHA256

      789e97a5c99efcbcb3cad73b0ed7e69eb7dfa525b1c098b6e47f607823cefecb

    • SHA512

      3d1a9fd15593801d1b678036a49394e608fb30e4bb6405f3a6ef972652d22cd9d4132c7ad0140d38ef8895fc5d66d13f42e972cab9ffc629237ce193a312a455

    • SSDEEP

      6144:jPgG6aJGObkpAvjnQsmYGoygDBa4RFCpO:jPgG6KGOiAzFzG0DBQI

    Score
    10/10
    njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks