5881ED83EF800AC9CBC9E74C6A9E403521AFED344105E.exe

General
Target

5881ED83EF800AC9CBC9E74C6A9E403521AFED344105E.exe

Size

23KB

Sample

210915-zvkn7abcc6

Score
10 /10
MD5

40d8409cbbafe7fc7ee3132f00ad9423

SHA1

849c0f16a80cc4c1acd1dfa875de31e028e2ecfc

SHA256

5881ed83ef800ac9cbc9e74c6a9e403521afed344105ee157d66916e70ff63df

SHA512

90d66e223935efa2ccba3b2bb5b2533bd0f33ea6def1057ff210bfca1f0235698a60949825b8e695d3d5e532aa672a72058e35389761534955c8e55246606684

Malware Config

Extracted

Family njrat
Version 0.7d
Botnet mscode
C2

hotkey.ddns.net:5552

Attributes
reg_key
2f547573b829f3eb843eb77706c321e3
splitter
|'|'|
Targets
Target

5881ED83EF800AC9CBC9E74C6A9E403521AFED344105E.exe

MD5

40d8409cbbafe7fc7ee3132f00ad9423

Filesize

23KB

Score
10/10
SHA1

849c0f16a80cc4c1acd1dfa875de31e028e2ecfc

SHA256

5881ed83ef800ac9cbc9e74c6a9e403521afed344105ee157d66916e70ff63df

SHA512

90d66e223935efa2ccba3b2bb5b2533bd0f33ea6def1057ff210bfca1f0235698a60949825b8e695d3d5e532aa672a72058e35389761534955c8e55246606684

Tags

Signatures

  • njRAT/Bladabindi

    Description

    Widely used RAT written in .NET.

    Tags

  • Executes dropped EXE

  • Modifies Windows Firewall

    Tags

    TTPs

    Modify Existing Service
  • Loads dropped DLL

  • Adds Run key to start application

    Tags

    TTPs

    Registry Run Keys / Startup FolderModify Registry

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Privilege Escalation
                    Tasks

                    static1

                    10/10