General

  • Target

    b02448be6d957bc18ed6a1b97038ed1a.exe

  • Size

    353KB

  • Sample

    211028-1fx7eaccc2

  • MD5

    b02448be6d957bc18ed6a1b97038ed1a

  • SHA1

    33e8945ccc4f088a33977e75ec791ba6591880b4

  • SHA256

    11c0380a1944b579293ffb34e61b3dfdeaeebd712a5fcf1b2f377b50c5e49113

  • SHA512

    9fef4b91950c584e2390fa536084c01ea4f1ec9f397b26e2f98036425d261135c3d91b512e88d6328bcfd8ad1e0f42eabbf54f8b090af95ee1671b3bc9899a09

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

6.tcp.ngrok.io:19425

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      b02448be6d957bc18ed6a1b97038ed1a.exe

    • Size

      353KB

    • MD5

      b02448be6d957bc18ed6a1b97038ed1a

    • SHA1

      33e8945ccc4f088a33977e75ec791ba6591880b4

    • SHA256

      11c0380a1944b579293ffb34e61b3dfdeaeebd712a5fcf1b2f377b50c5e49113

    • SHA512

      9fef4b91950c584e2390fa536084c01ea4f1ec9f397b26e2f98036425d261135c3d91b512e88d6328bcfd8ad1e0f42eabbf54f8b090af95ee1671b3bc9899a09

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

MITRE ATT&CK Enterprise v6

Tasks