Overview

overview

10

Static

static

3

d90fa1d764...d5.exe

windows7-x64

10

d90fa1d764...d5.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d90fa1d7642354da268e0eadb417be46626fbe74e68364aa0a80a1ba08f017d5.exe

  • Size

    3.2MB

  • Sample

    241231-rqznjstrdx

  • MD5

    ee6463bd6ab5a0299ce45091cc84f703

  • SHA1

    4ba4d91c7db4d895f3cfbb684140a0463a472a5d

  • SHA256

    d90fa1d7642354da268e0eadb417be46626fbe74e68364aa0a80a1ba08f017d5

  • SHA512

    a440ee567a831193ce0e8001d08cdd5b46b6d94a19b64f7ceb7cb0037ccb99d3c5390d79686f9557800ab73789df4a2c75b72349b799de541c94ab27f6b53a5e

  • SSDEEP

    98304:ZtiwNlunVqirIBmG9Li2JWrV2yM0SlNevauUaO/tCI4:Zt9unlrIBT9LVJoV2yM0SlNevwCV

Score
10/10
njratquasaraxotrojanowneddefense_evasiondiscoveryevasionpersistenceprivilege_escalationspywaretrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Owned

C2

hakim32.ddns.net:2000

167.71.56.116:22342
Mutex

24983f03fb74576bbc5af6aa1085b23d

Attributes
  • reg_key

    24983f03fb74576bbc5af6aa1085b23d

  • splitter

    |'|'|

Extracted

Family

quasar

Version

1.4.1

Botnet

Axotrojan

C2

eu-central-7075.packetriot.net:22342

167.71.56.116:22342
Mutex

34892381-1dda-4b06-87a2-3e413b932ac8

Attributes
  • encryption_key

    4B13DC71783277444E966E1D66F9171ABFC15E88

  • install_name

    Clientformyslut.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Axo startup

  • subdirectory

    SubDir

Targets

    • Target

      d90fa1d7642354da268e0eadb417be46626fbe74e68364aa0a80a1ba08f017d5.exe

    • Size

      3.2MB

    • MD5

      ee6463bd6ab5a0299ce45091cc84f703

    • SHA1

      4ba4d91c7db4d895f3cfbb684140a0463a472a5d

    • SHA256

      d90fa1d7642354da268e0eadb417be46626fbe74e68364aa0a80a1ba08f017d5

    • SHA512

      a440ee567a831193ce0e8001d08cdd5b46b6d94a19b64f7ceb7cb0037ccb99d3c5390d79686f9557800ab73789df4a2c75b72349b799de541c94ab27f6b53a5e

    • SSDEEP

      98304:ZtiwNlunVqirIBmG9Li2JWrV2yM0SlNevauUaO/tCI4:Zt9unlrIBT9LVJoV2yM0SlNevwCV

    Score
    10/10
    njratquasaraxotrojanowneddefense_evasiondiscoveryevasionpersistenceprivilege_escalationspywaretrojan

    • Njrat family

      njrat

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar family

      quasar

    • Quasar payload

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Obfuscated Files or Information

1
T1027

Command Obfuscation

1
T1027.010

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks