General

  • Target

    99c065515cad2265f7f826e355c22f8c677682da498d2ae74b2cb96ee27c5ad9

  • Size

    22KB

  • Sample

    220128-qn7qpsdcem

  • MD5

    659844803074f32b274708507df3118c

  • SHA1

    104dbcade45c3a01b499bd7ecb73852a5adf6146

  • SHA256

    99c065515cad2265f7f826e355c22f8c677682da498d2ae74b2cb96ee27c5ad9

  • SHA512

    008d57f5846c85e6ef8ad4a35a5a6838c925dacb9c829fb420c1896581490afcfe27edbfe6e69fa7f32d5fe1eeb06d3f2f8f28eb2cda930c4ab32bf184877986

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

sooosoo45.publicvm.com:1111

Mutex

2c75cccb239930e4a48b4948a4a9098c

Attributes
  • reg_key

    2c75cccb239930e4a48b4948a4a9098c

  • splitter

    |'|'|

Targets

    • Target

      99c065515cad2265f7f826e355c22f8c677682da498d2ae74b2cb96ee27c5ad9

    • Size

      22KB

    • MD5

      659844803074f32b274708507df3118c

    • SHA1

      104dbcade45c3a01b499bd7ecb73852a5adf6146

    • SHA256

      99c065515cad2265f7f826e355c22f8c677682da498d2ae74b2cb96ee27c5ad9

    • SHA512

      008d57f5846c85e6ef8ad4a35a5a6838c925dacb9c829fb420c1896581490afcfe27edbfe6e69fa7f32d5fe1eeb06d3f2f8f28eb2cda930c4ab32bf184877986

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks