Overview

overview

10

Static

static

3

JaffaCakes...aa.exe

windows7-x64

10

JaffaCakes...aa.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_52406ab5bc64563c1eb544c201c943aa

  • Size

    276KB

  • Sample

    250101-mzpgqavqcp

  • MD5

    52406ab5bc64563c1eb544c201c943aa

  • SHA1

    54a8ff5e620f03a98adde2bb0eb42c7fc80d7c1c

  • SHA256

    473f047c2ce0905a6a93ce61e38ff40612c547560c433938c69eb27691e9868f

  • SHA512

    96dc4579bce2e8860f56b48231ae9a1dd0ac4ec71d5a058bfcc5991b2498521a36a018bfa7afbcaeaec116995803c45c93f1f0463d5135eb5a5c9e55a21871b6

  • SSDEEP

    6144:Pg9OvfU5US1IhI88u0p4tA5eyeNZmz85VBWYx07Q6D:IOv85zcI8vA5MnmwIYo/

Score
10/10
njratserverdiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

server

C2

psycho77777.ddns.net:1177

Mutex

24b6054fc8f5be0070f08d51b2a1dd72

Attributes
  • reg_key

    24b6054fc8f5be0070f08d51b2a1dd72

  • splitter

    |'|'|

Targets

    • Target

      JaffaCakes118_52406ab5bc64563c1eb544c201c943aa

    • Size

      276KB

    • MD5

      52406ab5bc64563c1eb544c201c943aa

    • SHA1

      54a8ff5e620f03a98adde2bb0eb42c7fc80d7c1c

    • SHA256

      473f047c2ce0905a6a93ce61e38ff40612c547560c433938c69eb27691e9868f

    • SHA512

      96dc4579bce2e8860f56b48231ae9a1dd0ac4ec71d5a058bfcc5991b2498521a36a018bfa7afbcaeaec116995803c45c93f1f0463d5135eb5a5c9e55a21871b6

    • SSDEEP

      6144:Pg9OvfU5US1IhI88u0p4tA5eyeNZmz85VBWYx07Q6D:IOv85zcI8vA5MnmwIYo/

    Score
    10/10
    njratserverdiscoveryevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks