General

  • Target

    ad3c59b601947fb2b8a168a575d61e1b91871ba575e6f9944ef6fc6d7f49f35f

  • Size

    183KB

  • Sample

    221123-qnfbfsed69

  • MD5

    46f6970e0c667458b3cd2dc367bee4ed

  • SHA1

    656aff66e1ed6a73d37c3a3759a467cc8e3cfb81

  • SHA256

    ad3c59b601947fb2b8a168a575d61e1b91871ba575e6f9944ef6fc6d7f49f35f

  • SHA512

    ae74b6ab60c0c673502e95ecdaaec93d19ddcd7c2c808cba1a7ed1f462fc41a005a94a09cbe889fb63588cb8e445950432027d590c45b4c902b7e0a34ec2230d

  • SSDEEP

    3072:toYuRLo2fqHftI0gE0TzU+uDV12lDsjsnTdHQ7:SLLp6fOPm12uonTdw

Score
10/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

خاروف

C2

elie-asper2.no-ip.biz:777

Mutex

d2d53faff928ddfe7c27b3f334867c81

Attributes
  • reg_key

    d2d53faff928ddfe7c27b3f334867c81

  • splitter

    |'|'|

Targets

    • Target

      ad3c59b601947fb2b8a168a575d61e1b91871ba575e6f9944ef6fc6d7f49f35f

    • Size

      183KB

    • MD5

      46f6970e0c667458b3cd2dc367bee4ed

    • SHA1

      656aff66e1ed6a73d37c3a3759a467cc8e3cfb81

    • SHA256

      ad3c59b601947fb2b8a168a575d61e1b91871ba575e6f9944ef6fc6d7f49f35f

    • SHA512

      ae74b6ab60c0c673502e95ecdaaec93d19ddcd7c2c808cba1a7ed1f462fc41a005a94a09cbe889fb63588cb8e445950432027d590c45b4c902b7e0a34ec2230d

    • SSDEEP

      3072:toYuRLo2fqHftI0gE0TzU+uDV12lDsjsnTdHQ7:SLLp6fOPm12uonTdw

    Score
    10/10
    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks