General

  • Target

    48c3a3ada659fff5dd6571878fa4e5aa4d0e0caf683c9d48e44f75c027835781

  • Size

    23KB

  • Sample

    210929-k11v2aecd7

  • MD5

    72c391745df454a943727593554897dd

  • SHA1

    da75bba892bb982e62246e2e13135a69b8010440

  • SHA256

    48c3a3ada659fff5dd6571878fa4e5aa4d0e0caf683c9d48e44f75c027835781

  • SHA512

    2185660926d742b24412cd71f4040c0044f803d199d6fa9fcf9805af65de00dab4f29555a2cd4e9b54d14cd12bb00bf415d894bb0739a4ddc050068acfb51af7

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

10.10.10.10:5552

Mutex

0dc24807523d3cd24b54cd0996e4c49b

Attributes
  • reg_key

    0dc24807523d3cd24b54cd0996e4c49b

  • splitter

    |'|'|

Targets

    • Target

      48c3a3ada659fff5dd6571878fa4e5aa4d0e0caf683c9d48e44f75c027835781

    • Size

      23KB

    • MD5

      72c391745df454a943727593554897dd

    • SHA1

      da75bba892bb982e62246e2e13135a69b8010440

    • SHA256

      48c3a3ada659fff5dd6571878fa4e5aa4d0e0caf683c9d48e44f75c027835781

    • SHA512

      2185660926d742b24412cd71f4040c0044f803d199d6fa9fcf9805af65de00dab4f29555a2cd4e9b54d14cd12bb00bf415d894bb0739a4ddc050068acfb51af7

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks