General

  • Target

    e2ee9010ffc04e93475c14d0eec88610258cca058c25a6409914341b59c0b68c

  • Size

    341KB

  • Sample

    210929-jqedlsebd7

  • MD5

    e8fb8e14c5e50dd51a7499b84e2c857a

  • SHA1

    bad853c5496bc28f492c01cdc6fff77efd72dc74

  • SHA256

    e2ee9010ffc04e93475c14d0eec88610258cca058c25a6409914341b59c0b68c

  • SHA512

    2b15a3c3cb4b04f978043d45ac32ed2ab7dfef11ec0b6010a73a2d39b8aa112b18846cb60383c63108fd7bcd4c7f9abae26b354320902a59f923d436d73f4131

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

cvcvc

C2

127.0.0.1:6544

Mutex

f08ba698cf12b161ed2e70452386d723

Attributes
  • reg_key

    f08ba698cf12b161ed2e70452386d723

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target

      e2ee9010ffc04e93475c14d0eec88610258cca058c25a6409914341b59c0b68c

    • Size

      341KB

    • MD5

      e8fb8e14c5e50dd51a7499b84e2c857a

    • SHA1

      bad853c5496bc28f492c01cdc6fff77efd72dc74

    • SHA256

      e2ee9010ffc04e93475c14d0eec88610258cca058c25a6409914341b59c0b68c

    • SHA512

      2b15a3c3cb4b04f978043d45ac32ed2ab7dfef11ec0b6010a73a2d39b8aa112b18846cb60383c63108fd7bcd4c7f9abae26b354320902a59f923d436d73f4131

    • Modifies Windows Defender Real-time Protection settings

    • Modifies security service

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Nirsoft

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Stops running service(s)

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks