General

  • Target

    e9dd44bc93c6600e1de03f26f733cc003836f6fb58bfee6a89783ffa5bae86e5

  • Size

    179KB

  • Sample

    220508-jewhraebfp

  • MD5

    05f591b5044b5e8689879cbd885c920b

  • SHA1

    dc77c9a8e58497f86df64d22e24b2fc9852de49c

  • SHA256

    e9dd44bc93c6600e1de03f26f733cc003836f6fb58bfee6a89783ffa5bae86e5

  • SHA512

    545855689ec71d304dd48ffbf4a3db509ff5afcccdf40480d1c3c2e9a44ac18ef1912ea1be7c111fbe30ff1b6a16bbce24749943ca2c70b88cbcf74e3698e3a5

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

system

C2

bozuksaatiniz.duckdns.org:1604

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      e9dd44bc93c6600e1de03f26f733cc003836f6fb58bfee6a89783ffa5bae86e5

    • Size

      179KB

    • MD5

      05f591b5044b5e8689879cbd885c920b

    • SHA1

      dc77c9a8e58497f86df64d22e24b2fc9852de49c

    • SHA256

      e9dd44bc93c6600e1de03f26f733cc003836f6fb58bfee6a89783ffa5bae86e5

    • SHA512

      545855689ec71d304dd48ffbf4a3db509ff5afcccdf40480d1c3c2e9a44ac18ef1912ea1be7c111fbe30ff1b6a16bbce24749943ca2c70b88cbcf74e3698e3a5

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks