Overview

overview

10

Static

static

10

mos ssssttttt.exe

windows7-x64

10

mos ssssttttt.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    mos ssssttttt.exe

  • Size

    93KB

  • Sample

    241213-m5pdxawmhx

  • MD5

    8be7cd574b5424c43a6d0ccc4a989412

  • SHA1

    946d22547849765d756071f63be3417b30f39c6f

  • SHA256

    87a40d2e8ebe033ff3d359309dda136f1bced5c5578c8ea7d05b9d97e5adb12f

  • SHA512

    8aff9965a7c8ccb357b3e026c2b65eb0457d4967ddbbb269f781ce62c9c77667b3a7ed4e8794bdaff6a7adfd46757cf1579bf740ec5a0d2747efa824bcf18eeb

  • SSDEEP

    1536:lIEQIBlfGQFk2ZonmzlMxjEwzGi1dD1DYgS:lICtFk2ZonmZMOi1dxB

Score
10/10
njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:444
Mutex

990be91699f271511aed6c9147533362

Attributes
  • reg_key

    990be91699f271511aed6c9147533362

  • splitter

    |'|'|

Targets

    • Target

      mos ssssttttt.exe

    • Size

      93KB

    • MD5

      8be7cd574b5424c43a6d0ccc4a989412

    • SHA1

      946d22547849765d756071f63be3417b30f39c6f

    • SHA256

      87a40d2e8ebe033ff3d359309dda136f1bced5c5578c8ea7d05b9d97e5adb12f

    • SHA512

      8aff9965a7c8ccb357b3e026c2b65eb0457d4967ddbbb269f781ce62c9c77667b3a7ed4e8794bdaff6a7adfd46757cf1579bf740ec5a0d2747efa824bcf18eeb

    • SSDEEP

      1536:lIEQIBlfGQFk2ZonmzlMxjEwzGi1dD1DYgS:lICtFk2ZonmZMOi1dxB

    Score
    10/10
    njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks