General

  • Target

    2d12f385866e1909e347e8e72fd865a5.exe

  • Size

    37KB

  • Sample

    221003-jbtjzsdcd9

  • MD5

    2d12f385866e1909e347e8e72fd865a5

  • SHA1

    7a4cd5557784673f6928b1d1483c049f8be8fb84

  • SHA256

    a0a129f04cc9d5c95f0d5acf38bad7e6445b7927df02cb7c97b657acfa52f30e

  • SHA512

    a86d492423783546476e8c9375c24e606fb1bc2f35ef1ecfd0dee7c44fad6052315ee96c8a621d50527fa26c4969cfaa2484a2928dbae7e2912ca50083af9aad

  • SSDEEP

    384:beELEUiFsbK7FmpE8QyEfQEP/gfPMIArAF+rMRTyN/0L+EcoinblneHQM3epzXPD:6EH2n8LEfQEg3MZrM+rMRa8Nu9Bt

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

2.tcp.ngrok.io:16659

Mutex

89d3f61949714a743b59b2a86520fae7

Attributes
  • reg_key

    89d3f61949714a743b59b2a86520fae7

  • splitter

    |'|'|

Targets

    • Target

      2d12f385866e1909e347e8e72fd865a5.exe

    • Size

      37KB

    • MD5

      2d12f385866e1909e347e8e72fd865a5

    • SHA1

      7a4cd5557784673f6928b1d1483c049f8be8fb84

    • SHA256

      a0a129f04cc9d5c95f0d5acf38bad7e6445b7927df02cb7c97b657acfa52f30e

    • SHA512

      a86d492423783546476e8c9375c24e606fb1bc2f35ef1ecfd0dee7c44fad6052315ee96c8a621d50527fa26c4969cfaa2484a2928dbae7e2912ca50083af9aad

    • SSDEEP

      384:beELEUiFsbK7FmpE8QyEfQEP/gfPMIArAF+rMRTyN/0L+EcoinblneHQM3epzXPD:6EH2n8LEfQEg3MZrM+rMRa8Nu9Bt

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks