General

  • Target

    e933200c50ed87ef3215904c3cfe2920_exe32.exe

  • Size

    425KB

  • Sample

    231015-yjwrmsac56

  • MD5

    e933200c50ed87ef3215904c3cfe2920

  • SHA1

    bad3bb1e8893109821672db903adb71b2af3b007

  • SHA256

    936a934e72770ce483d26756349d19b97479945e829162d1f53787237b08c666

  • SHA512

    bf9cb20cab6abdab4a9746a31101514bb035df47045457c1a88000f2c3a76c66c377ab48a3c42b582969d29a7e8001d5fb5eb11b71f536d473ad798a1cd8a2c5

  • SSDEEP

    12288:WquErHF6xC9D6DmR1J98w4oknqO/CyQftQYqYbLmK8:brl6kD68JmlokQfttqY2K8

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

14 mai generateur xbox

C2

89.94.35.57:1604

Mutex

ef05e501c2e286164abf5fcaa961559f

Attributes
  • reg_key

    ef05e501c2e286164abf5fcaa961559f

  • splitter

    |'|'|

Targets

    • Target

      e933200c50ed87ef3215904c3cfe2920_exe32.exe

    • Size

      425KB

    • MD5

      e933200c50ed87ef3215904c3cfe2920

    • SHA1

      bad3bb1e8893109821672db903adb71b2af3b007

    • SHA256

      936a934e72770ce483d26756349d19b97479945e829162d1f53787237b08c666

    • SHA512

      bf9cb20cab6abdab4a9746a31101514bb035df47045457c1a88000f2c3a76c66c377ab48a3c42b582969d29a7e8001d5fb5eb11b71f536d473ad798a1cd8a2c5

    • SSDEEP

      12288:WquErHF6xC9D6DmR1J98w4oknqO/CyQftQYqYbLmK8:brl6kD68JmlokQfttqY2K8

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks