Overview

overview

10

Static

static

10

RAT NIGGA.jar

windows10-ltsc 2021-x64

RAT NIGGA.jar

windows11-21h2-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    RAT NIGGA.jar

  • Size

    639KB

  • Sample

    241108-ad953stlak

  • MD5

    eaf4f869a0be0418568b88301e8318e5

  • SHA1

    0f5efc7f8fea65eaa0bca6746ff72eeb4d65bd9e

  • SHA256

    1e8d94d04b2d21fe062345f4f2eb5bd6896f420e1a98c17eaf0105236ae52b67

  • SHA512

    2c746db76c9f9987d85809d7598b9a24558d8a1b1c98e77e0398725258b1611e7227dacd7efa094a8f0bdf9cb16b2aae794c5ddcea3a02f6bb153c4403a99c9a

  • SSDEEP

    12288:YPvPQT/dZzqF149PE/+HgK/nRf+9ZYN2Xgg+1CRja3cuQ2hESQBDI7:YP3QLvqj4lTHgKZms2XtoNcu9hXQBDI7

Score
10/10
adwinddefense_evasionpersistencephishing

Malware Config

Targets

    • Target

      RAT NIGGA.jar

    • Size

      639KB

    • MD5

      eaf4f869a0be0418568b88301e8318e5

    • SHA1

      0f5efc7f8fea65eaa0bca6746ff72eeb4d65bd9e

    • SHA256

      1e8d94d04b2d21fe062345f4f2eb5bd6896f420e1a98c17eaf0105236ae52b67

    • SHA512

      2c746db76c9f9987d85809d7598b9a24558d8a1b1c98e77e0398725258b1611e7227dacd7efa094a8f0bdf9cb16b2aae794c5ddcea3a02f6bb153c4403a99c9a

    • SSDEEP

      12288:YPvPQT/dZzqF149PE/+HgK/nRf+9ZYN2Xgg+1CRja3cuQ2hESQBDI7:YP3QLvqj4lTHgKZms2XtoNcu9hXQBDI7

    Score
    8/10
    defense_evasionpersistencephishing

    • Downloads MZ/PE file

    • A potential corporate email address has been identified in the URL: 93263704532955710A490D44@AdobeOrg

      phishing

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks