General

  • Target

    977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15

  • Size

    1.4MB

  • Sample

    210914-hfd5esabfl

  • MD5

    7692667d5a258ba4cdb84473fb50efdc

  • SHA1

    3102de64a4476befc1684c4595f24ec707472662

  • SHA256

    977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15

  • SHA512

    1b365067b03c94bacf8f22b5cc32e7a6b85b6359a215f197e6c4747e956ce409de94a5bc8c543af76e98983516a07d111c35ac66f99f85b3e0b7d6858b2052fb

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

Test1

C2

127.0.0.1:1177

Mutex

6bc405af81ea48ffdc111c35dcd0d4b4

Attributes
  • reg_key

    6bc405af81ea48ffdc111c35dcd0d4b4

  • splitter

    |'|'|

Targets

    • Target

      977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15

    • Size

      1.4MB

    • MD5

      7692667d5a258ba4cdb84473fb50efdc

    • SHA1

      3102de64a4476befc1684c4595f24ec707472662

    • SHA256

      977565988377bf3f44444095ecb38c87432ce4bae2059da4aa75124ef1c3de15

    • SHA512

      1b365067b03c94bacf8f22b5cc32e7a6b85b6359a215f197e6c4747e956ce409de94a5bc8c543af76e98983516a07d111c35ac66f99f85b3e0b7d6858b2052fb

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Tasks