General
- Target VIRUS 63h.rar
- Size 2.9MB
- Sample260926-2g1jlashjg
- SHA256 5ba40ab0e5903b377fdb0f39c9670ed425d6cb6a34746f2f41579f9f1a2f5f14
Malware Config
Extracted
-
njrat
-
<- NjRAT 0.7d Horror Edition ->
-
Victim
-
28.tcp.cpolar.top:10588
-
0142361c52dce97ca26729e3ae908113
-
reg_key
0142361c52dce97ca26729e3ae908113
-
splitter
Y262SUCZ4UJJ
Targets
-
- Target 63h 1.exe
- Size 11KB
- SHA256 1a7610cd29d915c7f4ad68d5238e4dd3cfc973de57ad81a177ba8ae5cb9a86c5
Score3/10 -
- Target 63h 2.exe
- Size 11KB
- SHA256 ce8c71661f7b8b6f0c32dd0cb079fe8f8bdbc63f769dc38ea9ab698d4a9c60fd
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies system executable filetype association
-
- Target AngryVirus.exe
- Size 482KB
- SHA256 b6dac480e4c7f15e8de6633ee9b52b3bda0b6b2f1897a76ddb4ab0ffb76b2588
Score1/10 -
- Target Chernobyl.exe
- Size 1.2MB
- SHA256 2342b3d3120400baea76a500a710fc239ea8d1c587459c4c20bc070e44281c27
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Modifies system executable filetype association
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target Commandos.exe
- Size 79KB
- SHA256 e0c0bb0b89ded0bcad1a4fbd9d7d989cacffe9c2dd963a89e86e13582cdf8262
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Executes dropped EXE
-
Modifies system executable filetype association
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target HighHappy.exe
- Size 82KB
- SHA256 0f9617c86fd1a744a7185e1060b928cd05ddd63c70633dbe847d5582e60101fe
Score8/10-
Disables Task Manager via registry modification
-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies system executable filetype association
-
Indicator Removal: File Deletion
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target Knuckles.exe
- Size 289KB
- SHA256 1f98a3f8852d28ed3b2f64e529c1ae1eafc5ef942a962ec89163f3db2744c8a4
Score6/10-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target Magellan.exe
- Size 167KB
- SHA256 5f9c6b82e9f287d67b30c6edac1e8e606b6fb719206c88c5421846d48d64d271
Score7/10-
Executes dropped EXE
-
Drops file in System32 directory
-
- Target MasonChess.exe
- Size 1.3MB
- SHA256 9be0c047cea06ab24bdb1711ca7d4608e179826d079206ed36a1aea830cc5149
Score7/10-
Executes dropped EXE
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target MasonExln9.exe
- Size 77KB
- SHA256 622cce1035f8cdb86e362c430557e5c30f39a27bc53f7ccf201f51ba1bb3a965
Score6/10-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target MatrixVirus.exe
- Size 14KB
- SHA256 5906dc7c3cd938b874cfb12cd9a14a6e72116c31385f4584f997f1544e3da492
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies system executable filetype association
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target PEEKABOO.COM
- Size 921KB
- SHA256 c1aeab35f61f12db28274d82713bff400b808625854a18e49504022f92805e31
Score1/10 -
- Target Payload.exe
- Size 55KB
- SHA256 b6b1bd5cc42381299e7edb715fe6918b24e538d3c8c0070bfcaecd834d7656d3
Score10/10-
Family: njRAT/Bladabindi
Widely used RAT written in .NET.
-
Adds Run key to start application
-
- Target Smil.exe
- Size 365KB
- SHA256 f534bb9d7cc4c0f8abf8adcc592a328a64a902211ab66bafd9a0c7a333e86a20
Score1/10 -
- Target Squidward.exe
- Size 535KB
- SHA256 2b6455abbf84755be4dcf840ebbfed9c480dced7bd74806bafee05465a5e752d
Score7/10-
Executes dropped EXE
-
Drops file in System32 directory
-
- Target Stalin.exe
- Size 30KB
- SHA256 4f50bb2cd893f1f225e02f66ecf0765830f078265e81096dbf551589cc641d43
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
- Target Virus 63h/63h 1.exe
- Size 11KB
- SHA256 1a7610cd29d915c7f4ad68d5238e4dd3cfc973de57ad81a177ba8ae5cb9a86c5
Score6/10-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
Drops file in System32 directory
-
- Target Virus 63h/63h 2.exe
- Size 11KB
- SHA256 ce8c71661f7b8b6f0c32dd0cb079fe8f8bdbc63f769dc38ea9ab698d4a9c60fd
Score7/10-
Event Triggered Execution: Component Object Model Hijacking
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
-
Modifies system executable filetype association
-
- Target Virus 63h/Payload.exe
- Size 55KB
- SHA256 b6b1bd5cc42381299e7edb715fe6918b24e538d3c8c0070bfcaecd834d7656d3
Score10/10-
Family: njRAT/Bladabindi
Widely used RAT written in .NET.
-
Adds Run key to start application
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1Windows Command Shell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Pre-OS Boot
1Bootkit
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
2Active Setup
1Registry Run Keys / Startup Folder
1Event Triggered Execution
2Change Default File Association
1Component Object Model Hijacking
1Process Injection
1Process Hollowing
1Scheduled Task/Job
1Scheduled Task
1Defense Evasion
Indicator Removal
1File Deletion
1Modify Registry
5Pre-OS Boot
1Bootkit
1Process Injection
1Process Hollowing
1