Overview

overview

10

Static

static

3

JaffaCakes...3a.exe

windows7-x64

10

JaffaCakes...3a.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_1b3a00bccae34f2a27efa64874bc833a

  • Size

    304KB

  • Sample

    250106-k9qfnavpcn

  • MD5

    1b3a00bccae34f2a27efa64874bc833a

  • SHA1

    1054afc9e13efffb17fa1a899752ef38aa6c63a9

  • SHA256

    9a3d7a18eb3b69d572ff6c3d9b1421b311f2b87adebb98556aa8d24ffb7432fb

  • SHA512

    1a137a86036a49a09e030fa09a6e2f57ae99ee1f26a653d8025c3401245b38d54d54077a842c494470ab1bafae3c888f7b67a1161894ac91de2ecc9e3279a642

  • SSDEEP

    3072:Spjg0qgNOGQxT8V2jV5+nPL/s9sTb7BKwlggggggc:o1qJ2V23yPqo

Score
10/10
njrathackedevasionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

checkout.capeturk.com:4444

Mutex

Client Server Runtime Process

Attributes
  • reg_key

    Client Server Runtime Process

  • splitter

    |'|'|

Targets

    • Target

      JaffaCakes118_1b3a00bccae34f2a27efa64874bc833a

    • Size

      304KB

    • MD5

      1b3a00bccae34f2a27efa64874bc833a

    • SHA1

      1054afc9e13efffb17fa1a899752ef38aa6c63a9

    • SHA256

      9a3d7a18eb3b69d572ff6c3d9b1421b311f2b87adebb98556aa8d24ffb7432fb

    • SHA512

      1a137a86036a49a09e030fa09a6e2f57ae99ee1f26a653d8025c3401245b38d54d54077a842c494470ab1bafae3c888f7b67a1161894ac91de2ecc9e3279a642

    • SSDEEP

      3072:Spjg0qgNOGQxT8V2jV5+nPL/s9sTb7BKwlggggggc:o1qJ2V23yPqo

    Score
    10/10
    njrathackedevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks