Overview

overview

10

Static

static

3

JaffaCakes...40.exe

windows7-x64

10

JaffaCakes...40.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_6e2f5978d70a44b39ca8cc9128556440

  • Size

    95KB

  • Sample

    250103-vsd2eatrgx

  • MD5

    6e2f5978d70a44b39ca8cc9128556440

  • SHA1

    b9e4e557e0fcec642b31c8041cdca1c3ca543a37

  • SHA256

    48c0f6f7f79f3db7e190eb53b2e9a447ca9218a5fdf2e741e0e4e7cfa5431063

  • SHA512

    7cf9046396aebce674cd54e9ad30f6577a60c22e1489de1b4987e1a7a25457a17581a8851c7e0943306722994406d5d00377c3a6e5f39330614048e0cec341e1

  • SSDEEP

    1536:wYoRZBGJmPhoUtAGzCDbyRiL7deGFfLwxg0mTIGapJpp:wYiPhpX+Db3ndeGhMLr/n

Score
10/10
njrathackedevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

nod327.no-ip.biz:1153

Mutex

9c9e5f3b01650e64c8401e786abd95b0

Attributes
  • reg_key

    9c9e5f3b01650e64c8401e786abd95b0

  • splitter

    |'|'|

Targets

    • Target

      JaffaCakes118_6e2f5978d70a44b39ca8cc9128556440

    • Size

      95KB

    • MD5

      6e2f5978d70a44b39ca8cc9128556440

    • SHA1

      b9e4e557e0fcec642b31c8041cdca1c3ca543a37

    • SHA256

      48c0f6f7f79f3db7e190eb53b2e9a447ca9218a5fdf2e741e0e4e7cfa5431063

    • SHA512

      7cf9046396aebce674cd54e9ad30f6577a60c22e1489de1b4987e1a7a25457a17581a8851c7e0943306722994406d5d00377c3a6e5f39330614048e0cec341e1

    • SSDEEP

      1536:wYoRZBGJmPhoUtAGzCDbyRiL7deGFfLwxg0mTIGapJpp:wYiPhpX+Db3ndeGhMLr/n

    Score
    10/10
    njrathackedevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks