General

  • Target

    d7df5d8bb14f27d0772623cfe2906a8f2ba6717ec9d3f06b633e3aeee782a675

  • Size

    93KB

  • Sample

    220701-gevv4sedfk

  • MD5

    e9d171e5b1c5efc89e580912ec391906

  • SHA1

    23c8855cad568a45aebeb640e42ab7254076f540

  • SHA256

    d7df5d8bb14f27d0772623cfe2906a8f2ba6717ec9d3f06b633e3aeee782a675

  • SHA512

    b56a7c1b605e0c8cfb6134e28ec0b8b915784677a3da7d58c635dadaa81a962d0af5a4d984c495653e9a57daee14e0d232faa85b9194b2ce87960d76cb07b7a8

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

FRANSESCOTI3LjAuFRANSESCOC4x:NTU1Mw==

Mutex

17e7855137332dfa4f631e0bc88ed208

Attributes
  • reg_key

    17e7855137332dfa4f631e0bc88ed208

  • splitter

    |'|'|

Targets

    • Target

      d7df5d8bb14f27d0772623cfe2906a8f2ba6717ec9d3f06b633e3aeee782a675

    • Size

      93KB

    • MD5

      e9d171e5b1c5efc89e580912ec391906

    • SHA1

      23c8855cad568a45aebeb640e42ab7254076f540

    • SHA256

      d7df5d8bb14f27d0772623cfe2906a8f2ba6717ec9d3f06b633e3aeee782a675

    • SHA512

      b56a7c1b605e0c8cfb6134e28ec0b8b915784677a3da7d58c635dadaa81a962d0af5a4d984c495653e9a57daee14e0d232faa85b9194b2ce87960d76cb07b7a8

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Disables Task Manager via registry modification

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Drops startup file

    • Loads dropped DLL

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Execution

Scheduled Task

1
T1053

Persistence

Modify Existing Service

1
T1031

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Tasks