General

  • Target

    jopa.exe

  • Size

    346KB

  • Sample

    220704-pdqh1ahbbr

  • MD5

    c54c1e78c781a6c95919a012c30c0c32

  • SHA1

    9ad3a3a9ba4f5fa997298c893e085dd77f635b0b

  • SHA256

    c4e8a78d7af808b4fe0fa7d8c7da2b2e6a364264621ccf520578c9d5d05baa5a

  • SHA512

    975e318b4c18e9b0590de04e2c3762a7a70ee9313d8335a2bb46b0a1307887aeb52567463542dbcf09c9b35bed3a624bab1b18d43f6beddca1ce9d0384ddee94

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

gay

C2

2.tcp.eu.ngrok.io:11696

Mutex

b40c8069f7901ea328823f37ffd1b3b2

Attributes
  • reg_key

    b40c8069f7901ea328823f37ffd1b3b2

  • splitter

    |'|'|

Extracted

Family

njrat

Version

im523

Botnet

NEXT

C2

109.197.196.135:9991

Mutex

413491cbe232876548b9b7cd8a1b451d

Attributes
  • reg_key

    413491cbe232876548b9b7cd8a1b451d

  • splitter

    |'|'|

Targets

    • Target

      jopa.exe

    • Size

      346KB

    • MD5

      c54c1e78c781a6c95919a012c30c0c32

    • SHA1

      9ad3a3a9ba4f5fa997298c893e085dd77f635b0b

    • SHA256

      c4e8a78d7af808b4fe0fa7d8c7da2b2e6a364264621ccf520578c9d5d05baa5a

    • SHA512

      975e318b4c18e9b0590de04e2c3762a7a70ee9313d8335a2bb46b0a1307887aeb52567463542dbcf09c9b35bed3a624bab1b18d43f6beddca1ce9d0384ddee94

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

      suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

    • suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

      suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Capture)

    • ModiLoader Second Stage

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

1
T1091

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Replication Through Removable Media

1
T1091

Tasks