Overview

overview

10

Static

static

10

SteamDetector.exe

windows7-x64

10

SteamDetector.exe

windows10-2004-x64

8

Sharing

Copy URL
Twitter E-mail

General

  • Target

    SteamDetector.exe

  • Size

    215KB

  • Sample

    250123-grflyswkcw

  • MD5

    c7bb7b93bc4327b0190c852138cc4f0c

  • SHA1

    af779bc979d9d4515510b60511ef14d1d3331f47

  • SHA256

    bcb6f8e7702380c8f2eec6393a4a4d414027d75786593072e524aef7f4d232cd

  • SHA512

    56a4fe9007421e2a0a0afbfc12d1b3fa8544ff71986282292608966725e2a436b751fc4aa7a7bb99a0dfe50aada7419c4450d01dd94ac78251ab8ce33d432d55

  • SSDEEP

    1536:56N9uMvWCo+gRJNQkZqH5u3JPyaoBypISq8JhrCdupRKV:567ukc+yJSkA5u3JPn++rq8JhudupRK

Score
10/10
njrathackeddefense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

46422e05e6e5062fec6d0ab906669fb9

Attributes
  • reg_key

    46422e05e6e5062fec6d0ab906669fb9

  • splitter

    |'|'|

Targets

    • Target

      SteamDetector.exe

    • Size

      215KB

    • MD5

      c7bb7b93bc4327b0190c852138cc4f0c

    • SHA1

      af779bc979d9d4515510b60511ef14d1d3331f47

    • SHA256

      bcb6f8e7702380c8f2eec6393a4a4d414027d75786593072e524aef7f4d232cd

    • SHA512

      56a4fe9007421e2a0a0afbfc12d1b3fa8544ff71986282292608966725e2a436b751fc4aa7a7bb99a0dfe50aada7419c4450d01dd94ac78251ab8ce33d432d55

    • SSDEEP

      1536:56N9uMvWCo+gRJNQkZqH5u3JPyaoBypISq8JhrCdupRKV:567ukc+yJSkA5u3JPn++rq8JhudupRK

    Score
    10/10
    njrathackeddefense_evasiondiscoverypersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1
T1091

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Replication Through Removable Media

1
T1091

Collection

Command and Control

Exfiltration

Impact

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.