General

  • Target

    3D8B03DD0D32E8B35E85D8F3FE30C4DF806607B506C46.exe

  • Size

    254KB

  • Sample

    210914-yytwlagcb9

  • MD5

    0a8eb56e089d298f7dab780b3218e504

  • SHA1

    5963b1eb8243672225721ee5ce897eae2c748f8f

  • SHA256

    3d8b03dd0d32e8b35e85d8f3fe30c4df806607b506c465c35ca66c2e93ae489d

  • SHA512

    b650775cf304a323e22cdeee3da91acb10bc80a9f7d6e4e913c7f5d5cfe9c0533e89ae8af3a0338813e4439841f01dd7c6a5729d83a4034bacf89ea39cd3a066

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

fr3onhoms.ddns.net:5552

Mutex

39142952441e8c6dd1c68259493b5832

Attributes
  • reg_key

    39142952441e8c6dd1c68259493b5832

  • splitter

    |'|'|

Targets

    • Target

      3D8B03DD0D32E8B35E85D8F3FE30C4DF806607B506C46.exe

    • Size

      254KB

    • MD5

      0a8eb56e089d298f7dab780b3218e504

    • SHA1

      5963b1eb8243672225721ee5ce897eae2c748f8f

    • SHA256

      3d8b03dd0d32e8b35e85d8f3fe30c4df806607b506c465c35ca66c2e93ae489d

    • SHA512

      b650775cf304a323e22cdeee3da91acb10bc80a9f7d6e4e913c7f5d5cfe9c0533e89ae8af3a0338813e4439841f01dd7c6a5729d83a4034bacf89ea39cd3a066

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

System Information Discovery

1
T1082

Tasks