Description
Widely used RAT written in .NET.
0x000b000000003c9f-55.dat
General
Target
Size
Sample
0x000b000000003c9f-55.dat
37KB
220521-tsh5paddaq
Score
10 /10
MD5
SHA1
SHA256
SHA512
05d1abc69e538eb3c86bfeacc33c2a10
f424222562968f86d5d043cce57b1a0389061150
cf37aa59e0d281f372b3801bcd62dba2dbf280d6f9edb48dc9c1565897d81918
e8aa15db240a82a24e8143df79fec3356e60942df6c26ca4ea995108d9e165292679dc94ea4ff55a7831ac0a47a938c45594733e48052aabf865284229751526
Malware Config
Extracted
| Family | njrat |
| Version | im523 |
| Botnet | WormRATT |
| C2 |
178.33.93.88:1742 |
| Attributes |
reg_key 7869d44e9b90d6b1e669bf52c9e89c61
splitter |'|'| |
Targets
Target
MD5
Filesize
0x000b000000003c9f-55.dat
05d1abc69e538eb3c86bfeacc33c2a10
37KB
Score
10/10
SHA1
SHA256
SHA512
f424222562968f86d5d043cce57b1a0389061150
cf37aa59e0d281f372b3801bcd62dba2dbf280d6f9edb48dc9c1565897d81918
e8aa15db240a82a24e8143df79fec3356e60942df6c26ca4ea995108d9e165292679dc94ea4ff55a7831ac0a47a938c45594733e48052aabf865284229751526
Tags
Signatures
-
njRAT/Bladabindi
-
Executes dropped EXE
-
Modifies Windows Firewall
Tags
TTPs
-
Checks computer location settings
Description
Looks up country code configured in the registry, likely geofence.
TTPs
-
Drops startup file
-
Loads dropped DLL
-
Adds Run key to start application
Tags
TTPs
-
Drops autorun.inf file
Description
Malware can abuse Windows Autorun to spread further via attached volumes.
TTPs
Related Tasks
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Privilege Escalation
Tasks