Overview

overview

10

Static

static

3

sec-checke...AB.exe

windows7-x64

10

sec-checke...AB.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b3f9720fbf0a87810e1e3fd38c541de5_JaffaCakes118

  • Size

    445KB

  • Sample

    241129-27kaas1nbw

  • MD5

    b3f9720fbf0a87810e1e3fd38c541de5

  • SHA1

    25b4e24757d22e064a0e12e780aaaa8e367f71df

  • SHA256

    20963aed9ff246e13e89c2d51c92dd11323d82a96a878c81e072c8d97f34f99f

  • SHA512

    845443be498ec1a9ee514eeab37baa690abeae44ca07132c7af29602efbe1ad6dbc6de93fb67747c530d1c9e0d89a9be4865375db552bac2002dbe6677c24158

  • SSDEEP

    12288:d+zapgnZ0nxoK8pcJFuaDWM6BPWVtFNV0dX:4zlCnx82bRS/WDLUX

Score
10/10
njratحمودي الواسطي كان هناdiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

حمودي الواسطي كان هنا

C2

moha.no-ip.biz:9933

Mutex

0834daba34fc76fcb705a66b2338d64f

Attributes
  • reg_key

    0834daba34fc76fcb705a66b2338d64f

  • splitter

    |'|'|

Targets

    • Target

      sec-checker v1 By SECURITY ALSHAAB.exe

    • Size

      1020KB

    • MD5

      333c9b031872ecad95a227cb504c62ae

    • SHA1

      2cde63d3c03fd8d7b138232492ee7b7fbe1683aa

    • SHA256

      adaee5abda04e7cf460f707a2cfbea01a550bda20204cdcb1df2da194551a681

    • SHA512

      887e1a1e92c6d0542e9e226f7441ef55bd0e698d4f6c61e7b7fcb90c28cadcee24d96af56ccdb7ed0c2f5dace7ca929cfb0302d05fa07975621c186fc4ea48ba

    • SSDEEP

      12288:RfziWJL5SZaSCDaRze4Yl4fRCVhBwvQlebZBUwFt:RfLwOp4Yl6IwvQlebZzt

    Score
    10/10
    njratحمودي الواسطي كان هناdiscoveryevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

3
T1112

Subvert Trust Controls

1
T1553

Install Root Certificate

1
T1553.004

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks