Overview

overview

10

Static

static

10

P.exe

windows10-ltsc_2021-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    P.exe
  • Size 222KB
  • Sample260804-ngx7ksdm91
  • SHA256 3bb6e4c78d2f675947e9051c55a8f3adcf402ef741ebf7c1ab5c2abb6cc13c58
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
njratbym7talexecutionpersistencetrojan

Malware Config

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • ByM7TAL

C2

  • 31.6.50.206:2013

Mutex

  • 60b329f13607f1692f26a5f75ec2f517

Attributes
  • reg_key

    60b329f13607f1692f26a5f75ec2f517

  • splitter

    |'|'|

Targets

    • Target
      P.exe
    • Size 222KB
    • SHA256 3bb6e4c78d2f675947e9051c55a8f3adcf402ef741ebf7c1ab5c2abb6cc13c58
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    bym7talexecutionnjratpersistencetrojan

    • Family: njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks