MALICIOUS — 66c8041d27975655f2a1bb1b42e454ad51a0e4e93dfbbf765fb995afdeaa40d0

MALICIOUS — 66c8041d27975655f2a1bb1b42e454ad51a0e4e93dfbbf765fb995afdeaa40d0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Njrat family. 6 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 66c8041d27975655f2a1bb1b42e454ad51a0e4e93dfbbf765fb995afdeaa40d0
SHA-1: 189e2ab5411b58b1ffbf35c18cca694a37deddda
MD5: 844ae82c8e8abd371e8c926725f7ead0
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 384:dslUlEvOEJ8xWwYJOMiOBZEdj1567gtwi5HhbQmRvR6JZlbw8hqIusZzZ60:OeEvwIlLMRpcnuU
TLSH: T1722B17A815260E7CC9B7AC192A59A43DF1C19C0DE8B6375907411631A8E4F3B2F3937B
Submitted as: 66c8041d27975655f2a1bb1b42e454ad51a0e4e93dfbbf765fb995afdeaa40d0
File type: pe · Size: 24064 bytes
Verdict: malicious (100/100) · Family: Njrat

Detections (6 of 56 engines)

capa (capabilities): capability:execution/powershell
ClamAV (daily): Win.Packed.Generic-9795615-0
Microsoft Defender: Backdoor:MSIL/Bladabindi
Emsisoft (Emergency Kit): Trojan.Bladabindi
Trellix Stinger (McAfee): Trojan-FIGN
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Packed.Generic-9795615-0 (rule Win.Packed.Generic-9795615-0) - engine signal, weight 0.90, confidence 0.95
3 behavioral detection(s) across 3 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.66, confidence 0.90
Microsoft Defender flagged Backdoor:MSIL/Bladabindi (rule Backdoor:MSIL/Bladabindi) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Bladabindi (rule Trojan.Bladabindi) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FIGN (rule Trojan-FIGN) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted Njrat config (0 C2) - engine signal, weight 0.45, confidence 0.60
capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

15485 behavior events · 3 ATT&CK techniques · 14 dropped files.

Dropped files

6cedab65cefa2ca7182c3c1ae232dd754db7c1de6ea3d8ba5e49495efc9db89c - 6cedab65cefa2ca7182c3c1ae232dd754db7c1de6ea3d8ba5e49495efc9db89c
cc41f7a7c57e34aca84fadecfb04bfc711f1716e3c4810021456231d0a8296b7 - cc41f7a7c57e34aca84fadecfb04bfc711f1716e3c4810021456231d0a8296b7
706648935b2ab23f981b6a0b805b19e2623f4c96b02e46dcaef33b6fb65ff2e3 - 706648935b2ab23f981b6a0b805b19e2623f4c96b02e46dcaef33b6fb65ff2e3
73dfb4ea01ae1dbfb4b92a6190f040f4808fc2b6dd880fc2be02221aace2e0bd - 73dfb4ea01ae1dbfb4b92a6190f040f4808fc2b6dd880fc2be02221aace2e0bd
8470676e0befb47ff3b53e512aa013c24a16af574561cc7b91250fae8da20185 - 8470676e0befb47ff3b53e512aa013c24a16af574561cc7b91250fae8da20185
e8d4f75c4a971a9db0e62f31ddf6799804e297e4e555ca38f758b0410d72bb35 - e8d4f75c4a971a9db0e62f31ddf6799804e297e4e555ca38f758b0410d72bb35
48278fa769c426decd23ca4a80938a5eba9bb2c0d4ed55d7f3e39fa92a6e33f8 - 48278fa769c426decd23ca4a80938a5eba9bb2c0d4ed55d7f3e39fa92a6e33f8
7dea00695b2ccd6dfadc864886b779636056c79123fc3ff7f2551a3073126792 - 7dea00695b2ccd6dfadc864886b779636056c79123fc3ff7f2551a3073126792
e6f027b3ee04ec21e5380afbd46c5763e1ade283e48291cbacf8a48eebda862c - e6f027b3ee04ec21e5380afbd46c5763e1ade283e48291cbacf8a48eebda862c
3080dc029eb4e3f3741a152d5457421879f963c0f17921f03b8a6de1d41e0847 - 3080dc029eb4e3f3741a152d5457421879f963c0f17921f03b8a6de1d41e0847
f21751a47f324b868942fef880519913b2e4e5b94c1d6f213ab54d2673e37ccb - f21751a47f324b868942fef880519913b2e4e5b94c1d6f213ab54d2673e37ccb
6a3280550f0ff7f3375bd5692d080168c5120c327e612f15023b09612c01e5ef - 6a3280550f0ff7f3375bd5692d080168c5120c327e612f15023b09612c01e5ef
b9e23c917c95387c253d7bb90b0d027b749172c6fc26faecfdb29dc7126ed718 - b9e23c917c95387c253d7bb90b0d027b749172c6fc26faecfdb29dc7126ed718
2e2af672026b70d096548213963cb8f99052a3bad653a4549de2f5d36f506f67 - 2e2af672026b70d096548213963cb8f99052a3bad653a4549de2f5d36f506f67

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

10.10.10.10
20.50.201.200
52.123.252.218
57.155.101.212
4.144.132.114
4.230.171.124
20.42.179.192
74.178.240.51
20.184.175.2
74.178.76.128
135.232.92.137
135.234.160.245
172.215.188.232
20.42.65.93
13.69.116.108
52.110.12.16
52.110.12.3
72.145.35.108
52.148.114.188

More Njrat samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report