Overview

overview

10

Static

static

3

d9508a6739...18.exe

windows7-x64

10

d9508a6739...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d9508a6739d129c598756d3cc13911fe_JaffaCakes118

  • Size

    455KB

  • Sample

    241209-m8jb3avqhz

  • MD5

    d9508a6739d129c598756d3cc13911fe

  • SHA1

    ece3eae0e5c29c42b25aa765b71f087aee24f8bd

  • SHA256

    8eb73615f94599f30d8978dee514e1a622ad20dc8230eb2e9c89c9f9dc736d89

  • SHA512

    d4ef69fa7b79413ad4d4413247291d50e6d8452622370709810806e7b4288a69e92b31525592169cb1fb71435f5493e00db677cf2e92544e2f10c3079d9216f4

  • SSDEEP

    6144:qjbeiIng03OLVp2KAS0aEyBB+CMwQ8XCM66iO/PCWpBEaOltxH1cWRSfzbrwL/:qudgWS5AsEVC6qEJO/PdB2i4azbrwz

Score
10/10
njrat1blddiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

1bld

C2

moneyplayboy88.ddns.net:1604

Mutex

5cba3755d9669704d2e4b04d63e79642

5cba3755d9669704d2e4b04d63e79642
Attributes
  • reg_key

    5cba3755d9669704d2e4b04d63e79642

  • splitter

    |'|'|

Targets

    • Target

      d9508a6739d129c598756d3cc13911fe_JaffaCakes118

    • Size

      455KB

    • MD5

      d9508a6739d129c598756d3cc13911fe

    • SHA1

      ece3eae0e5c29c42b25aa765b71f087aee24f8bd

    • SHA256

      8eb73615f94599f30d8978dee514e1a622ad20dc8230eb2e9c89c9f9dc736d89

    • SHA512

      d4ef69fa7b79413ad4d4413247291d50e6d8452622370709810806e7b4288a69e92b31525592169cb1fb71435f5493e00db677cf2e92544e2f10c3079d9216f4

    • SSDEEP

      6144:qjbeiIng03OLVp2KAS0aEyBB+CMwQ8XCM66iO/PCWpBEaOltxH1cWRSfzbrwL/:qudgWS5AsEVC6qEJO/PdB2i4azbrwz

    Score
    10/10
    njrat1blddiscoveryevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks