Overview

overview

10

Static

static

10

Payloaسس...3d.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Payloaسسسسسسسس33333333333d.exe
  • Size 55KB
  • Sample260815-vv41ls1sht
  • SHA256 19dc828a606429c629effb7ab70c1b6e20af1638b02f5cb0f2f36abe202c4d12
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
njratvictimdiscoverytrojan

Malware Config

Extracted

Family

  • njrat

Version

  • <- NjRAT 0.7d Horror Edition ->

Botnet

  • Victim

C2

  • labobo-35094.portmap.host:1194

Mutex

  • 1e4859827296410d0dd487fac0e51f72

Attributes
  • reg_key

    1e4859827296410d0dd487fac0e51f72

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target
      Payloaسسسسسسسس33333333333d.exe
    • Size 55KB
    • SHA256 19dc828a606429c629effb7ab70c1b6e20af1638b02f5cb0f2f36abe202c4d12
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    victimdiscoverynjrattrojan

    • Family: njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks