Overview

overview

10

Static

static

3

38fdd127d1...2N.exe

windows7-x64

10

38fdd127d1...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    38fdd127d155587e46643e9ce269951ab8f3c41563437613dc5709aeadfceb32N.exe

  • Size

    3.2MB

  • Sample

    241230-qg1zksyle1

  • MD5

    7b9480d4a112833514e7bb79434ac910

  • SHA1

    9050db3991eaa8a2ab8d0485877f54e096660036

  • SHA256

    38fdd127d155587e46643e9ce269951ab8f3c41563437613dc5709aeadfceb32

  • SHA512

    125e94039981aa6072a352dddcc531f58cdc3d9db9bb0557c3ba1561fcd40b7d0fea76b06701ec7e53248c4c0e6ac607c7d8e71dfde0a0221abff9eaa006b693

  • SSDEEP

    98304:ZtiwNlunVqirIBmG9Li2JWrV2yM0SlNevauUaO/tCI:Zt9unlrIBT9LVJoV2yM0SlNevwC

Score
10/10
njratquasaraxotrojanowneddefense_evasiondiscoveryevasionpersistenceprivilege_escalationspywaretrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Owned

C2

hakim32.ddns.net:2000

167.71.56.116:22342
Mutex

24983f03fb74576bbc5af6aa1085b23d

Attributes
  • reg_key

    24983f03fb74576bbc5af6aa1085b23d

  • splitter

    |'|'|

Extracted

Family

quasar

Version

1.4.1

Botnet

Axotrojan

C2

eu-central-7075.packetriot.net:22342

167.71.56.116:22342
Mutex

34892381-1dda-4b06-87a2-3e413b932ac8

Attributes
  • encryption_key

    4B13DC71783277444E966E1D66F9171ABFC15E88

  • install_name

    Clientformyslut.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Axo startup

  • subdirectory

    SubDir

Targets

    • Target

      38fdd127d155587e46643e9ce269951ab8f3c41563437613dc5709aeadfceb32N.exe

    • Size

      3.2MB

    • MD5

      7b9480d4a112833514e7bb79434ac910

    • SHA1

      9050db3991eaa8a2ab8d0485877f54e096660036

    • SHA256

      38fdd127d155587e46643e9ce269951ab8f3c41563437613dc5709aeadfceb32

    • SHA512

      125e94039981aa6072a352dddcc531f58cdc3d9db9bb0557c3ba1561fcd40b7d0fea76b06701ec7e53248c4c0e6ac607c7d8e71dfde0a0221abff9eaa006b693

    • SSDEEP

      98304:ZtiwNlunVqirIBmG9Li2JWrV2yM0SlNevauUaO/tCI:Zt9unlrIBT9LVJoV2yM0SlNevwC

    Score
    10/10
    njratquasaraxotrojanowneddefense_evasiondiscoveryevasionpersistenceprivilege_escalationspywaretrojan

    • Njrat family

      njrat

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Obfuscated Files or Information

1
T1027

Command Obfuscation

1
T1027.010

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks