General

  • Target

    b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155

  • Size

    407KB

  • Sample

    210915-vgm5yaeagl

  • MD5

    857aff9992a47764185c61da2493c753

  • SHA1

    6efa34cd3fdb299fcd940c0719d3a172bac83164

  • SHA256

    b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155

  • SHA512

    fbb2a5bfb068d4f56e338dc67f4d1a171af3156de2b3d956a0a1bd9526706f370cdff16cfb136049468b3a71db4c7ce99349265d3841db7775d5389b7aab798a

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

pedrobedoya2021.duckdns.org:1980

Mutex

cf13c225ff474d45b

Attributes
  • reg_key

    cf13c225ff474d45b

  • splitter

    @!#&^%$

Targets

    • Target

      b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155

    • Size

      407KB

    • MD5

      857aff9992a47764185c61da2493c753

    • SHA1

      6efa34cd3fdb299fcd940c0719d3a172bac83164

    • SHA256

      b73dc9d5947dd389cbae282955568d35ae3a38acd24983b116cdd8eb7ef67155

    • SHA512

      fbb2a5bfb068d4f56e338dc67f4d1a171af3156de2b3d956a0a1bd9526706f370cdff16cfb136049468b3a71db4c7ce99349265d3841db7775d5389b7aab798a

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks