General

  • Target

    0a7a183e777365134ecc6b30d2ef6111.exe

  • Size

    37KB

  • Sample

    230325-k56l3sca46

  • MD5

    0a7a183e777365134ecc6b30d2ef6111

  • SHA1

    5e43a2d49c2aeb6c438d9e7999215693ef90254e

  • SHA256

    b9dac8380436e34e0698ff15fa73b6026a87294905bc5f9af9cab7298f208e07

  • SHA512

    5e12c77ab23e809501cfe44a6f6eb4b80f57965b88d897029e1d2a70850a3e3ff70c3bbe828969b31bccdd78759ae1d1745dad90efcbe7cac0f7914c2f01b215

  • SSDEEP

    384:VSSvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzX0:MS7TZ38fvCv3E1c1rM+rMRa8NuE3t

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

0.tcp.eu.ngrok.io:14888

Mutex

4bf7c75d2b9974791b37b4aa6f0605e4

Attributes
  • reg_key

    4bf7c75d2b9974791b37b4aa6f0605e4

  • splitter

    |'|'|

Targets

    • Target

      0a7a183e777365134ecc6b30d2ef6111.exe

    • Size

      37KB

    • MD5

      0a7a183e777365134ecc6b30d2ef6111

    • SHA1

      5e43a2d49c2aeb6c438d9e7999215693ef90254e

    • SHA256

      b9dac8380436e34e0698ff15fa73b6026a87294905bc5f9af9cab7298f208e07

    • SHA512

      5e12c77ab23e809501cfe44a6f6eb4b80f57965b88d897029e1d2a70850a3e3ff70c3bbe828969b31bccdd78759ae1d1745dad90efcbe7cac0f7914c2f01b215

    • SSDEEP

      384:VSSvEiTbTvpWNcZ0y8fvCv3v3cLkacpjrAF+rMRTyN/0L+EcoinblneHQM3epzX0:MS7TZ38fvCv3E1c1rM+rMRa8NuE3t

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Modify Existing Service

1
T1031

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Command and Control

Web Service

1
T1102

Tasks