Overview

overview

10

Static

static

3

omesfn.exe

windows10-ltsc_2021-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    omesfn.exe
  • Size 16.8MB
  • Sample260814-eck7safa53
  • SHA256 91b740341c9261688ca666bf5677b521cf4c6a1c1d3b29a185f3019f42ce7bc7
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
njrathackeddefense_evasiondiscoverypersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

  • njrat

Version

  • 0.7d

Botnet

  • HacKed

C2

  • hakim32.ddns.net:2000

  • fds6gbae3v.localto.net:4294

Mutex

  • b9c3a6c98ae0f4ff9d14378e06801af9

Attributes
  • reg_key

    b9c3a6c98ae0f4ff9d14378e06801af9

  • splitter

    |'|'|

Targets

    • Target
      omesfn.exe
    • Size 16.8MB
    • SHA256 91b740341c9261688ca666bf5677b521cf4c6a1c1d3b29a185f3019f42ce7bc7
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    hackeddefense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

    • Family: njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      defense_evasion

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Obfuscated Files or Information: Command Obfuscation

      Adversaries may obfuscate content during command execution to impede detection.

      defense_evasion
    behavioral1

MITRE ATT&CK Enterprise v16

Tasks