Overview

overview

10

Static

static

3

svchost.exe

windows7-x64

7

svchost.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    svchost.exe

  • Size

    41KB

  • Sample

    250106-rttlpsync1

  • MD5

    9018cdefb477211297f2c4700b3b22d0

  • SHA1

    9a51ce108cb8b69c790a7db80a8db90679198111

  • SHA256

    594153ddc3d2e891519fe258d61a75cac79486797c724801cf56c88213b9ea24

  • SHA512

    72b60e74096cbd9f9592568cf21d2cfe3dae2d17e9b1352ef6add6640b705b08d2a42fda262b00aae8f4d452a66f743f0741689aca8ed872c09626c92334c86e

  • SSDEEP

    768:NWgbRM+82TxFRkzxbmDg5CINaQC1OLhZsMWBH:NWgbRM+8g+xbmDQbWOLK

Score
10/10
njratpersistencetrojan

Malware Config

Targets

    • Target

      svchost.exe

    • Size

      41KB

    • MD5

      9018cdefb477211297f2c4700b3b22d0

    • SHA1

      9a51ce108cb8b69c790a7db80a8db90679198111

    • SHA256

      594153ddc3d2e891519fe258d61a75cac79486797c724801cf56c88213b9ea24

    • SHA512

      72b60e74096cbd9f9592568cf21d2cfe3dae2d17e9b1352ef6add6640b705b08d2a42fda262b00aae8f4d452a66f743f0741689aca8ed872c09626c92334c86e

    • SSDEEP

      768:NWgbRM+82TxFRkzxbmDg5CINaQC1OLhZsMWBH:NWgbRM+8g+xbmDQbWOLK

    Score
    10/10
    persistencenjrattrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Drops startup file

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks