General

  • Target

    708cf1ba53bcf247438662a935f6b8ae9018eb561021cb9995837305ad54a2a9

  • Size

    23KB

  • Sample

    221125-ztk9bshf4y

  • MD5

    3bd25ae2524b1c10505eec912b891755

  • SHA1

    00c8c6b7c1a532a8b1c8ba9563b27f0ec9c2f90e

  • SHA256

    708cf1ba53bcf247438662a935f6b8ae9018eb561021cb9995837305ad54a2a9

  • SHA512

    522f5e84df4f8a1b5b84c4b6816cf85bdf67d0d64441d1cc72b7c45078c3d273da084ae5a81d41bd14a0877ca9405fa135f29e142af5622ed00d9139caad5e4e

  • SSDEEP

    384:7cqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZqG:g30py6vhxaRpcnuu

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

dz39.no-ip.biz:1177

Mutex

7c0adee51d250f6c959d30ee9796d0aa

Attributes
  • reg_key

    7c0adee51d250f6c959d30ee9796d0aa

  • splitter

    |'|'|

Targets

    • Target

      708cf1ba53bcf247438662a935f6b8ae9018eb561021cb9995837305ad54a2a9

    • Size

      23KB

    • MD5

      3bd25ae2524b1c10505eec912b891755

    • SHA1

      00c8c6b7c1a532a8b1c8ba9563b27f0ec9c2f90e

    • SHA256

      708cf1ba53bcf247438662a935f6b8ae9018eb561021cb9995837305ad54a2a9

    • SHA512

      522f5e84df4f8a1b5b84c4b6816cf85bdf67d0d64441d1cc72b7c45078c3d273da084ae5a81d41bd14a0877ca9405fa135f29e142af5622ed00d9139caad5e4e

    • SSDEEP

      384:7cqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZqG:g30py6vhxaRpcnuu

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Loads dropped DLL

MITRE ATT&CK Enterprise v6

Tasks