General
-
Target
a93ed17c2c3e33f492b26db316abb8a4d32923e03b2387b3076b2e00f7e7d732
-
Size
3.2MB
-
Sample
220309-wd4tysebdl
-
MD5
e33258409be6c2628cd2367ce1263386
-
SHA1
286a63a65463122c70eb82dadeb3ecca10aa68bc
-
SHA256
a93ed17c2c3e33f492b26db316abb8a4d32923e03b2387b3076b2e00f7e7d732
-
SHA512
0a10f5c4421af38785bd8fe672914574994525cfbc489e50c99c6242fead6c2720de4bc105e72db0793565f9b3ce667b28f69c890ae439dad68fab4ee161d5be
Static task
static1
Behavioral task
behavioral1
Sample
a93ed17c2c3e33f492b26db316abb8a4d32923e03b2387b3076b2e00f7e7d732.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
a93ed17c2c3e33f492b26db316abb8a4d32923e03b2387b3076b2e00f7e7d732.exe
Resource
win10v2004-en-20220112
Malware Config
Extracted
njrat
im523
hacker
0.tcp.ngrok.io:18133
707b4c9b457e788982fbb6845d3f32eb
-
reg_key
707b4c9b457e788982fbb6845d3f32eb
-
splitter
|'|'|
Targets
-
-
Target
a93ed17c2c3e33f492b26db316abb8a4d32923e03b2387b3076b2e00f7e7d732
-
Size
3.2MB
-
MD5
e33258409be6c2628cd2367ce1263386
-
SHA1
286a63a65463122c70eb82dadeb3ecca10aa68bc
-
SHA256
a93ed17c2c3e33f492b26db316abb8a4d32923e03b2387b3076b2e00f7e7d732
-
SHA512
0a10f5c4421af38785bd8fe672914574994525cfbc489e50c99c6242fead6c2720de4bc105e72db0793565f9b3ce667b28f69c890ae439dad68fab4ee161d5be
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-