Overview

overview

10

Static

static

10

Steam.Upgreyd.exe

windows7-x64

10

Steam.Upgreyd.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Steam.Upgreyd.exe

  • Size

    43KB

  • Sample

    241216-g4btjazjan

  • MD5

    f0aabba97f470b9a61755d9dfa2a3ff8

  • SHA1

    059523a98fca16f9211881c2bc3d8257f6cba0ed

  • SHA256

    3a3303bb8761484ee722c492b61c43793b64926e42bb3c90112765ae1cfe3406

  • SHA512

    5e1b52211cdfefaedc405825ba58dade787de82d1cfe789236c6b75b9273fe6896c44151dc775397438c269ea0a8edab7b9abfccab777a22f988e3843d634825

  • SSDEEP

    384:wZyM8Yz/wpa9GP4Uy29FDRZ448UEISFhqzIIij+ZsNO3PlpJKkkjh/TzF7pWnQ8W:2b8KR4gh29FDT4FUSQuXQ/o98U+L

Score
10/10
njrat[email protected]discoverypersistencetrojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

C2

sayrich.ddns.net:7777

Mutex

Yandex. Update

Attributes
  • reg_key

    Yandex. Update

  • splitter

    |Hassan|

Targets

    • Target

      Steam.Upgreyd.exe

    • Size

      43KB

    • MD5

      f0aabba97f470b9a61755d9dfa2a3ff8

    • SHA1

      059523a98fca16f9211881c2bc3d8257f6cba0ed

    • SHA256

      3a3303bb8761484ee722c492b61c43793b64926e42bb3c90112765ae1cfe3406

    • SHA512

      5e1b52211cdfefaedc405825ba58dade787de82d1cfe789236c6b75b9273fe6896c44151dc775397438c269ea0a8edab7b9abfccab777a22f988e3843d634825

    • SSDEEP

      384:wZyM8Yz/wpa9GP4Uy29FDRZ448UEISFhqzIIij+ZsNO3PlpJKkkjh/TzF7pWnQ8W:2b8KR4gh29FDT4FUSQuXQ/o98U+L

    Score
    10/10
    njrat[email protected]discoverypersistencetrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks