General

  • Target

    c031c4aa33d22d49250a70fb5443ca55edc70c3465ff8309646eb80b1276e73f

  • Size

    23KB

  • Sample

    221126-nszjsabe94

  • MD5

    7381e9658573cd91dc4bcfa8ca16b6c3

  • SHA1

    3dbdabbfd7ff982167877d195fc6575cf35063e6

  • SHA256

    c031c4aa33d22d49250a70fb5443ca55edc70c3465ff8309646eb80b1276e73f

  • SHA512

    cde152a1449c563b276c83fd4fa22c122ce2ae36bbb0ca07e5de1a54895f3c229a446702af9c55d45042fef6a8111c21c391d91b433912c7fbdc47edbdea5a68

  • SSDEEP

    384:U8aLWS0dABLYVq6RxP8MDFF09vK563gRMmJKUv0mRvR6JZlbw8hqIusZzZtM:zXcwt3tRpcnuJ

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

system

C2

127.0.0.1:5552

Mutex

312690745b3951573ca7c21d011ece33

Attributes
  • reg_key

    312690745b3951573ca7c21d011ece33

  • splitter

    |'|'|

Targets

    • Target

      c031c4aa33d22d49250a70fb5443ca55edc70c3465ff8309646eb80b1276e73f

    • Size

      23KB

    • MD5

      7381e9658573cd91dc4bcfa8ca16b6c3

    • SHA1

      3dbdabbfd7ff982167877d195fc6575cf35063e6

    • SHA256

      c031c4aa33d22d49250a70fb5443ca55edc70c3465ff8309646eb80b1276e73f

    • SHA512

      cde152a1449c563b276c83fd4fa22c122ce2ae36bbb0ca07e5de1a54895f3c229a446702af9c55d45042fef6a8111c21c391d91b433912c7fbdc47edbdea5a68

    • SSDEEP

      384:U8aLWS0dABLYVq6RxP8MDFF09vK563gRMmJKUv0mRvR6JZlbw8hqIusZzZtM:zXcwt3tRpcnuJ

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Executes dropped EXE

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks