x8209.xlsb

General
Target

x8209.xlsb

Size

116KB

Sample

210924-h69zsagcbj

Score
10 /10
MD5

c5a179c6fe1f057c380e64ad5a5151f1

SHA1

4b4c23004dab867b6759a921a24cfa181167ea62

SHA256

ca4010b0b7e840aed10f2439fc37429aa7c752cf8c312d5c3de01b3342dd69fb

SHA512

1ece527256a6460c99caf85b4c7ba399bf28796c5727a80b3f45176f47aef449145a92ccb7f55648dc41cb87391e322e8e6ac010b99a35ba9cf0aec0bb24e739

Malware Config

Extracted

Language xlm4.0
Source
URLs
xlm40.dropper

http://phod.ru/image1.png

Extracted

Family njrat
C2

ilfuoco.crabdance.com:1606

Attributes
reg_key
2cdbd061ab
splitter
@!#&^%$
Targets
Target

x8209.xlsb

MD5

c5a179c6fe1f057c380e64ad5a5151f1

Filesize

116KB

Score
10 /10
SHA1

4b4c23004dab867b6759a921a24cfa181167ea62

SHA256

ca4010b0b7e840aed10f2439fc37429aa7c752cf8c312d5c3de01b3342dd69fb

SHA512

1ece527256a6460c99caf85b4c7ba399bf28796c5727a80b3f45176f47aef449145a92ccb7f55648dc41cb87391e322e8e6ac010b99a35ba9cf0aec0bb24e739

Tags

Signatures

  • njRAT/Bladabindi

    Description

    Widely used RAT written in .NET.

    Tags

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Loads dropped DLL

Related Tasks

MITRE ATT&CK Matrix
Collection
    Command and Control
      Credential Access
        Defense Evasion
        Execution
          Exfiltration
            Impact
              Initial Access
                Lateral Movement
                  Persistence
                    Privilege Escalation
                      Tasks

                      static1

                      8/10

                      behavioral1

                      10/10

                      behavioral2

                      10/10