Documentacion.PDF.vbs

General
Target

Documentacion.PDF.vbs

Size

162KB

Sample

210915-pzmdgadgcm

Score
10 /10
MD5

16dd6afc5e63f4edc4f35fd1176e63bd

SHA1

d64a9461b703119695e76f880832924d487a648a

SHA256

c34173dfa5a1a842bb14ef1fddd8f15b0998577740469b6987d138e165786994

SHA512

3e2abe804b90ec51e1a7fb4145a0b11304e3d279c13cc3f65380721c079fb1b9711bb491e92b5e95c6ca957aeb7bfed9b33b030c094a1dcc3d4ebcab577b8df3

Malware Config

Extracted

Language ps1
Deobfuscated
URLs
ps1.dropper

https://onedrive.live.com/download?cid=4DBCDBEA8A120146&resid=4DBCDBEA8A120146%21152&authkey=AP1AB-SxiNqVg04

Extracted

Family njrat
Version 0.7NC
Botnet NYAN CAT
C2

pedrobedoya2021.duckdns.org:1980

Attributes
reg_key
cf13c225ff474d45b
splitter
@!#&^%$
Targets
Target

Documentacion.PDF.vbs

MD5

16dd6afc5e63f4edc4f35fd1176e63bd

Filesize

162KB

Score
10/10
SHA1

d64a9461b703119695e76f880832924d487a648a

SHA256

c34173dfa5a1a842bb14ef1fddd8f15b0998577740469b6987d138e165786994

SHA512

3e2abe804b90ec51e1a7fb4145a0b11304e3d279c13cc3f65380721c079fb1b9711bb491e92b5e95c6ca957aeb7bfed9b33b030c094a1dcc3d4ebcab577b8df3

Tags

Signatures

  • njRAT/Bladabindi

    Description

    Widely used RAT written in .NET.

    Tags

  • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    Description

    suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    Tags

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Drops startup file

  • Suspicious use of SetThreadContext

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
          Execution
            Exfiltration
              Impact
                Initial Access
                  Lateral Movement
                    Persistence
                      Privilege Escalation
                        Tasks

                        static1

                        behavioral1

                        10/10

                        behavioral2

                        10/10