General

  • Target

    VXUHEUR-Trojan.MSIL.Crypt.gen-6cd445a30c85396.exe

  • Size

    111KB

  • Sample

    220822-xz2r6aehf8

  • MD5

    88e469aebd9529524d4420e3bf7d4964

  • SHA1

    d8e22b9746702e583b5307b1ed1ac2a0f250f31b

  • SHA256

    6cd445a30c853960af9d9ce87a23bf57b22cb494a5c9fe216b2afb296f0654d6

  • SHA512

    5977c2755f82ab31375bd0ca99a8ef29d2eabc0a52b62dea40eacc80834250a626293fe017ea3adc5703157760438c5f535475a61b2bfe27a7d4576dfb6ed434

  • SSDEEP

    384:IL5zronO4Y1J9pMrI0CxPzdxRM9AQk93vmhm7UMKmIEecKdbXTzm9bVhca56Pr69:2JZXut9A/vMHTi9bDlZXvrBDp8r

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

Victime

C2

algiriano.ddns.net:6000

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Targets

    • Target

      VXUHEUR-Trojan.MSIL.Crypt.gen-6cd445a30c85396.exe

    • Size

      111KB

    • MD5

      88e469aebd9529524d4420e3bf7d4964

    • SHA1

      d8e22b9746702e583b5307b1ed1ac2a0f250f31b

    • SHA256

      6cd445a30c853960af9d9ce87a23bf57b22cb494a5c9fe216b2afb296f0654d6

    • SHA512

      5977c2755f82ab31375bd0ca99a8ef29d2eabc0a52b62dea40eacc80834250a626293fe017ea3adc5703157760438c5f535475a61b2bfe27a7d4576dfb6ed434

    • SSDEEP

      384:IL5zronO4Y1J9pMrI0CxPzdxRM9AQk93vmhm7UMKmIEecKdbXTzm9bVhca56Pr69:2JZXut9A/vMHTi9bDlZXvrBDp8r

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Hidden Files and Directories

1
T1158

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks