General

  • Target

    55d94ffcf330917328c6a586d6534d25.exe

  • Size

    37KB

  • Sample

    211220-kpv6eaaad9

  • MD5

    55d94ffcf330917328c6a586d6534d25

  • SHA1

    63d64293d07ceac441a14a52b713397bd99175b7

  • SHA256

    f68d863a9eebbaf7615a7b9c974f5a778a8fff581c6cbc6188e2c01671b267ab

  • SHA512

    2e677009cafb95ea0f045ef39f7afc843aa2dbb687928a23bfa082276232e23f5b806c2aa62d44b1c2d29ebc5081670111500f976ee36ffe6fe1acbd59a02e3f

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

185.204.1.234:5555

Mutex

e5a45bd689be1f7ca7b7912ac4ee9051

Attributes
  • reg_key

    e5a45bd689be1f7ca7b7912ac4ee9051

  • splitter

    |'|'|

Targets

    • Target

      55d94ffcf330917328c6a586d6534d25.exe

    • Size

      37KB

    • MD5

      55d94ffcf330917328c6a586d6534d25

    • SHA1

      63d64293d07ceac441a14a52b713397bd99175b7

    • SHA256

      f68d863a9eebbaf7615a7b9c974f5a778a8fff581c6cbc6188e2c01671b267ab

    • SHA512

      2e677009cafb95ea0f045ef39f7afc843aa2dbb687928a23bfa082276232e23f5b806c2aa62d44b1c2d29ebc5081670111500f976ee36ffe6fe1acbd59a02e3f

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks