Overview

overview

10

Static

static

10

Payload.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Payload.exe

  • Size

    55KB

  • Sample

    241208-vbm8ratqfr

  • MD5

    5c56be92df69c8add408d506c5532239

  • SHA1

    0dad011e6ddbd559d30217bf8b9da634a72c2023

  • SHA256

    b58ab675e6430d8d9eeb6d316a635f5eb62fb19cd1120b3d1376136df5c8a44e

  • SHA512

    85ebfc2be987a011bb4db28842a90a7be26560ee843600f0b39b0805980ba27cc00db7cd635305dfdeecb6333576c6ba501fe0f79d56f0cbe8eaa12ecc3560cf

  • SSDEEP

    1536:qPsoDnb4DNQ7SCCHDrwsNMDxXExI3pm9m:noDnEWOrHDrwsNMDxXExI3pm

Score
10/10
njratvictimdiscoverypersistencetrojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

C2

youth-latex.gl.at.ply.gg:56149

Mutex

4c4f4a71cf4fc204c1ef58ead9ffcdec

Attributes
  • reg_key

    4c4f4a71cf4fc204c1ef58ead9ffcdec

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target

      Payload.exe

    • Size

      55KB

    • MD5

      5c56be92df69c8add408d506c5532239

    • SHA1

      0dad011e6ddbd559d30217bf8b9da634a72c2023

    • SHA256

      b58ab675e6430d8d9eeb6d316a635f5eb62fb19cd1120b3d1376136df5c8a44e

    • SHA512

      85ebfc2be987a011bb4db28842a90a7be26560ee843600f0b39b0805980ba27cc00db7cd635305dfdeecb6333576c6ba501fe0f79d56f0cbe8eaa12ecc3560cf

    • SSDEEP

      1536:qPsoDnb4DNQ7SCCHDrwsNMDxXExI3pm9m:noDnEWOrHDrwsNMDxXExI3pm

    Score
    10/10
    njratdiscoverypersistencetrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Tasks