General

  • Target

    577b92a3a23917f55b1156d87ae4d4824894a3b15ae687ffa8b8af125a10438c

  • Size

    210KB

  • Sample

    220121-3vslksdfa6

  • MD5

    ffa1910f59d3f87c58246ec6f10dee76

  • SHA1

    7949faa337655377bdd8e8d4855094924f0195ba

  • SHA256

    577b92a3a23917f55b1156d87ae4d4824894a3b15ae687ffa8b8af125a10438c

  • SHA512

    e1e5b8ef1ac614402178df0538e9fa3649982e9ac5313a88663e535c36c449a90f334d61dfc5e99024d89e17d9cd0ccfaab5edcf11928a05a08ec675e58811cd

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

zalupa180417

C2

808080.ddns.net:5555

Mutex

4cb72bb7475074f5af41f3e5e189ee3f

Attributes
  • reg_key

    4cb72bb7475074f5af41f3e5e189ee3f

  • splitter

    |'|'|

Targets

    • Target

      Cirular-18April2017/Circular.Doc

    • Size

      264KB

    • MD5

      695c5d19dc3c3c5cc39182e09d9274e6

    • SHA1

      bc0aa3fce44b7d252919d820860709a0052cb76c

    • SHA256

      6ee76407efa8157b7f2b80a3a7ccc41581851aca58ab10cb8caf0243ce6fa436

    • SHA512

      a20bf0b073c43f55f9a8797e093422b2aea58949fa23e625e20ce9786421c120253cd4f988aa3b2f877d9cc7f6c472e8daabe58489d7b7ea2bec5c339e855e4b

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Drops startup file

    • Suspicious use of SetThreadContext

    • Target

      Cirular-18April2017/Circular.Doc.lnk

    • Size

      1KB

    • MD5

      f0093f6cb0dec239c81d9946380ea172

    • SHA1

      56a49a4d52b6f7fc94623c769df2aaf1b46f4c42

    • SHA256

      7818dd357bd780aae737e94f8f57b5b2cb643ceca8cc044c866d31d953ed3621

    • SHA512

      1af3a27846ee084941e4511500a6bfea5f51f97d9868e4f87711dc717a4651bde664d9ef234c2602b4def28522694a52ddc9ed6c259985a41936dac79e0f1ba2

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Drops startup file

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

2
T1031

Discovery

System Information Discovery

1
T1082

Tasks