Overview

overview

10

Static

static

10

sample.exe

windows7-x64

10

sample.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6c527a9e7bd5fff14bb9eee2b08b3b70

  • Size

    16KB

  • Sample

    250103-npqgps1mew

  • MD5

    6c527a9e7bd5fff14bb9eee2b08b3b70

  • SHA1

    59716b86d136ac284b2c62754e2082ca7e33ee3f

  • SHA256

    a7c87bea2e797dfe4af4a97a0e23aa3625e24f58d5e0b9067558fb8dab6f42cd

  • SHA512

    8aa847ee779a5177f0b9481396f6794bb35421f85f1f609507ce8205cfa0bdebb811f2fe3ccd52b02448a36d5f87a5a987df19b3addcc23af5e130df87a186b5

  • SSDEEP

    384:tgGlAueJ9xlctOZnoVfZ411oSclru2kLwQ51s:C2AuAPQOZoVfZ2cVulVw

Score
10/10
njrathacked by faresdiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed By Fares

C2

yoryounes.no-ip.biz:1177

Mutex

785d05353c980cbe0ee2249e87829808

Attributes
  • reg_key

    785d05353c980cbe0ee2249e87829808

  • splitter

    |'|'|

Targets

    • Target

      sample

    • Size

      29KB

    • MD5

      e364b1cc1166cd2b1abd2ddc45350238

    • SHA1

      a06d63e608a73acda0d2ac11ff8151d4b6293454

    • SHA256

      9360b296799be39b9e497fe82463f5f593a3bbcde957a3d673a52f3b5516ef6f

    • SHA512

      2b4e5bf0b0ee856c758540fe64e11e8999d777e266e9d67513b53ff170c6927294e8e7eda7b3d2844d52ad19f8fedeec52fcaad7cdf2b85ace9e68066793247d

    • SSDEEP

      384:EmCftl7ndJoc8e9v55Do7mmmqDspHe4qGBsbh0w4wlAokw9OhgOL1vYRGOZzPZYU:GD7zoc86xi74q8HeoBKh0p29SgR5D

    Score
    10/10
    njrathacked by faresdiscoveryevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks