General

  • Target

    706fd9eb22adac23c973248375c50a02.exe

  • Size

    27KB

  • Sample

    230326-q8ntbsaf8s

  • MD5

    706fd9eb22adac23c973248375c50a02

  • SHA1

    a2eb4719961cebca7a1e0ede2397c7e11e91a068

  • SHA256

    3d8b2bc3fdba588bad1e6ee74050de7a31e386088636bbedf72f2285d3dc819f

  • SHA512

    1e513b057abcebd61a5c808f026afeb16119172d8cde4e04a6d79997baa295c941a8594d0c39f1817117bbb94dba9c36f5a4bd81e123ab9fd0527bd6fadc42bf

  • SSDEEP

    384:hLOlYHHeIYTzJRcbg8iEPrthZMVAQk93vmhm7UMKmIEecKdbXTzm9bVhca66Zr6s:B2ZxJm8VA/vMHTi9bD

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

bob541882.e2.luyouxia.net:20192

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Targets

    • Target

      706fd9eb22adac23c973248375c50a02.exe

    • Size

      27KB

    • MD5

      706fd9eb22adac23c973248375c50a02

    • SHA1

      a2eb4719961cebca7a1e0ede2397c7e11e91a068

    • SHA256

      3d8b2bc3fdba588bad1e6ee74050de7a31e386088636bbedf72f2285d3dc819f

    • SHA512

      1e513b057abcebd61a5c808f026afeb16119172d8cde4e04a6d79997baa295c941a8594d0c39f1817117bbb94dba9c36f5a4bd81e123ab9fd0527bd6fadc42bf

    • SSDEEP

      384:hLOlYHHeIYTzJRcbg8iEPrthZMVAQk93vmhm7UMKmIEecKdbXTzm9bVhca66Zr6s:B2ZxJm8VA/vMHTi9bD

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Hidden Files and Directories

1
T1158

Defense Evasion

Modify Registry

1
T1112

Hidden Files and Directories

1
T1158

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Tasks