General

  • Target

    13715a69c1f82961fa3d3205b9368c83.exe

  • Size

    27KB

  • Sample

    220915-sdvz9sddc7

  • MD5

    13715a69c1f82961fa3d3205b9368c83

  • SHA1

    3b15a0c5fb6a177e12b3de81c7fc30dfda58555a

  • SHA256

    0fb86bb905fdc56eef57831ecfcc866a5e55c482462657353a4edfb29c1142ed

  • SHA512

    f180167942c5f2be95cf8c5089209459ed4a43c7e4270ee8129f7e261c82a52f1d34455fcc79dd920c6c7c8b04c4b9bdc8b323e5e224de414659559b04d99cba

  • SSDEEP

    384:5L96uj/+AU9038hfOexuaP39hRnMZAQk93vmhm7UMKmIEecKdbXTzm9bVhcam671:JE0mkspJtyZA/vMHTi9bD

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

2.tcp.eu.ngrok.io:12633

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Targets

    • Target

      13715a69c1f82961fa3d3205b9368c83.exe

    • Size

      27KB

    • MD5

      13715a69c1f82961fa3d3205b9368c83

    • SHA1

      3b15a0c5fb6a177e12b3de81c7fc30dfda58555a

    • SHA256

      0fb86bb905fdc56eef57831ecfcc866a5e55c482462657353a4edfb29c1142ed

    • SHA512

      f180167942c5f2be95cf8c5089209459ed4a43c7e4270ee8129f7e261c82a52f1d34455fcc79dd920c6c7c8b04c4b9bdc8b323e5e224de414659559b04d99cba

    • SSDEEP

      384:5L96uj/+AU9038hfOexuaP39hRnMZAQk93vmhm7UMKmIEecKdbXTzm9bVhcam671:JE0mkspJtyZA/vMHTi9bD

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Hidden Files and Directories

1
T1158

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks