Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

Everything.exe

windows7-x64

10

Everything.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Everything.exe

  • Size

    106KB

  • Sample

    250208-yv4lma1pey

  • MD5

    060317250cfe7e96901acc7c27a84bc7

  • SHA1

    0e85789e56309e5832dc7d2be081bd4193373ee7

  • SHA256

    d55ef4b76f8250026b20d9c61eb191f9078ff75b846f0d26b29b01c02cd24d35

  • SHA512

    7bbba13add3f69f5a18db2cb9df91725be607bc019c507a2e8feb4e6b45375261dae761682bcb481e5b2cb8e5a245e67c77318c1ff2654df6b7d82dc0532d27a

  • SSDEEP

    3072:s/I6viVfIHn9P4mF9bXKh8/s+oLIYXeWYs:s/IJIH9Pt080oYXe

Score
10/10
njratwindowsdiscoverypersistencetrojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

Windows

C2

127.0.0.1:10454

Mutex

windows.exe

Attributes
  • reg_key

    windows.exe

  • splitter

    |Ghost|

Targets

    • Target

      Everything.exe

    • Size

      106KB

    • MD5

      060317250cfe7e96901acc7c27a84bc7

    • SHA1

      0e85789e56309e5832dc7d2be081bd4193373ee7

    • SHA256

      d55ef4b76f8250026b20d9c61eb191f9078ff75b846f0d26b29b01c02cd24d35

    • SHA512

      7bbba13add3f69f5a18db2cb9df91725be607bc019c507a2e8feb4e6b45375261dae761682bcb481e5b2cb8e5a245e67c77318c1ff2654df6b7d82dc0532d27a

    • SSDEEP

      3072:s/I6viVfIHn9P4mF9bXKh8/s+oLIYXeWYs:s/IJIH9Pt080oYXe

    Score
    10/10
    njratwindowsdiscoverypersistencetrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

Remote System Discovery

1
T1018

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

System Network Configuration Discovery

1
T1016

Internet Connection Discovery

1
T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks