General

  • Target

    6c16c29393e52ccda35c043aea1b1940.exe

  • Size

    37KB

  • Sample

    230320-l7xydsch49

  • MD5

    6c16c29393e52ccda35c043aea1b1940

  • SHA1

    f440a53a8e1949aa361a311721b88efb7122e56a

  • SHA256

    4445051491aed9c868c6641f7b2ff844047b5e61414bbc6e440ef2d7202348a5

  • SHA512

    90d54c328c8443dcbba6be755578bd8c62fbb633000aafdba9d305e1b42a0e7b7bea8dfff978044c8712855ed72d71325f105ec1999c7a622e8d3bf6f7532f44

  • SSDEEP

    384:1SSvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXO:sS7TZ38fvCv3E1c1rM+rMRa8Nuvct

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

0.tcp.sa.ngrok.io:19784

Mutex

d129900b08bb5de7ee3568103142da72

Attributes
  • reg_key

    d129900b08bb5de7ee3568103142da72

  • splitter

    |'|'|

Targets

    • Target

      6c16c29393e52ccda35c043aea1b1940.exe

    • Size

      37KB

    • MD5

      6c16c29393e52ccda35c043aea1b1940

    • SHA1

      f440a53a8e1949aa361a311721b88efb7122e56a

    • SHA256

      4445051491aed9c868c6641f7b2ff844047b5e61414bbc6e440ef2d7202348a5

    • SHA512

      90d54c328c8443dcbba6be755578bd8c62fbb633000aafdba9d305e1b42a0e7b7bea8dfff978044c8712855ed72d71325f105ec1999c7a622e8d3bf6f7532f44

    • SSDEEP

      384:1SSvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzXO:sS7TZ38fvCv3E1c1rM+rMRa8Nuvct

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Command and Control

Web Service

1
T1102

Tasks