B513104971C9E0C5B6721A523C9475701A67BB368A74F.exe

General
Target

B513104971C9E0C5B6721A523C9475701A67BB368A74F.exe

Size

189KB

Sample

210914-1x1zmagdc5

Score
10 /10
MD5

0e95218e1c1f7d8f18227ce0efc4a3b2

SHA1

e9e8ae35e32e47c33f557d2deddb9e837450576a

SHA256

b513104971c9e0c5b6721a523c9475701a67bb368a74f4b8254049569a8497fe

SHA512

fa29aa2c09ab377c9eced2658474f60d418c363a4c4e318a7ed155688f55d80452f79414d76a31f56ca69b42363037764ada15145c6297c361cb281b631c34eb

Malware Config

Extracted

Family njrat
Version 0.7d
Botnet BackUp
C2

dr-mesho.ddns.net:5552

Attributes
reg_key
ce4ef724bbf43aa4dc51f763b9cf5592
splitter
|'|'|
Targets
Target

B513104971C9E0C5B6721A523C9475701A67BB368A74F.exe

MD5

0e95218e1c1f7d8f18227ce0efc4a3b2

Filesize

189KB

Score
10/10
SHA1

e9e8ae35e32e47c33f557d2deddb9e837450576a

SHA256

b513104971c9e0c5b6721a523c9475701a67bb368a74f4b8254049569a8497fe

SHA512

fa29aa2c09ab377c9eced2658474f60d418c363a4c4e318a7ed155688f55d80452f79414d76a31f56ca69b42363037764ada15145c6297c361cb281b631c34eb

Tags

Signatures

  • Modifies system executable filetype association

    Tags

    TTPs

    Modify RegistryChange Default File Association
  • njRAT/Bladabindi

    Description

    Widely used RAT written in .NET.

    Tags

  • Executes dropped EXE

  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Drops startup file

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry

Related Tasks

MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Privilege Escalation