Overview

overview

10

Static

static

3

JaffaCakes...95.exe

windows7-x64

10

JaffaCakes...95.exe

windows10-2004-x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_64b4b8b62a6f3ef20ea9b399098cb595

  • Size

    131KB

  • Sample

    250102-nfph2ssmdp

  • MD5

    64b4b8b62a6f3ef20ea9b399098cb595

  • SHA1

    7148aeacbb528b88e1b8edea3e29dc0c23bf097d

  • SHA256

    674761a1ce9afd9c373477be6c0510e0e275dec482749b68e2b01f99fad4bd4b

  • SHA512

    c3a9f14a1f428f00b52074da8d09cbe35f809203b733c8887752df6f09c78307e81b1753473a0ea0698681104e383c1f79dcb5bc41b3d065e9a428cc9c2c2b03

  • SSDEEP

    3072:J6SWBNtRRMfFJfZ4DYeUP2DsxVXEhHaa+BzlcMPgPt:JN8Zaf2Da+DoV6Haflcz

Score
10/10
njratبانياسيdiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

بانياسي

C2

skype-all.sytes.net:999

Mutex

1e2688313d1abc26db04d48d3dc3b7ea

Attributes
  • reg_key

    1e2688313d1abc26db04d48d3dc3b7ea

  • splitter

    |'|'|

Targets

    • Target

      JaffaCakes118_64b4b8b62a6f3ef20ea9b399098cb595

    • Size

      131KB

    • MD5

      64b4b8b62a6f3ef20ea9b399098cb595

    • SHA1

      7148aeacbb528b88e1b8edea3e29dc0c23bf097d

    • SHA256

      674761a1ce9afd9c373477be6c0510e0e275dec482749b68e2b01f99fad4bd4b

    • SHA512

      c3a9f14a1f428f00b52074da8d09cbe35f809203b733c8887752df6f09c78307e81b1753473a0ea0698681104e383c1f79dcb5bc41b3d065e9a428cc9c2c2b03

    • SSDEEP

      3072:J6SWBNtRRMfFJfZ4DYeUP2DsxVXEhHaa+BzlcMPgPt:JN8Zaf2Da+DoV6Haflcz

    Score
    10/10
    njratبانياسيdiscoveryevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks