General
-
Target
a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff
-
Size
3.2MB
-
Sample
220320-d47z7agcdn
-
MD5
562a9f62a55034e9c8aa9bbfa9850b16
-
SHA1
3b23806194ebfd8ba2215a0f11d9b0199791fe80
-
SHA256
a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff
-
SHA512
896b605c64f97323402cf45d2f0f505fd518344b9e96971a3b46d8ab972d7b8fbc48ac6d02d3c2e29da0311f37f97181eb1b6b2e79a3036d4ff02d22f4b86ce6
Static task
static1
Behavioral task
behavioral1
Sample
a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe
Resource
win7-20220311-en
Behavioral task
behavioral2
Sample
a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff.exe
Resource
win10v2004-en-20220113
Malware Config
Extracted
njrat
im523
hacker
2.tcp.ngrok.io:17639
7cf40e6a3924b89f8051713ab507eec7
-
reg_key
7cf40e6a3924b89f8051713ab507eec7
-
splitter
|'|'|
Targets
-
-
Target
a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff
-
Size
3.2MB
-
MD5
562a9f62a55034e9c8aa9bbfa9850b16
-
SHA1
3b23806194ebfd8ba2215a0f11d9b0199791fe80
-
SHA256
a0fb965b1d048e325d3fd08bdd6ea4106758052c5d63ad7f36e319f868782fff
-
SHA512
896b605c64f97323402cf45d2f0f505fd518344b9e96971a3b46d8ab972d7b8fbc48ac6d02d3c2e29da0311f37f97181eb1b6b2e79a3036d4ff02d22f4b86ce6
-
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
-
Executes dropped EXE
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops autorun.inf file
Malware can abuse Windows Autorun to spread further via attached volumes.
-