General

  • Target

    672ac1422873d7481b4d37c1c79b4818a96815cf271b0598ef01bdd9dabe3f74.zip

  • Size

    386KB

  • Sample

    231225-an5cksaedl

  • MD5

    21003dea8d3ee3f475e94c68d4b7df85

  • SHA1

    7acc6b2ca3d3506e805ff1b1e4eec8991a6d58db

  • SHA256

    66acf3bd3706faf43e19ea1cd985a5d9c98c4d9e3afa979ce3d809b4b1ee0779

  • SHA512

    2e30ac41d69b41aec4f73fd3983a5f35d0d46f603edf62195856e996e9fa90548cfb25c188c49a6f429e63414834c59beb4c8fa15e1826fa1bc273afdf683582

  • SSDEEP

    12288:SfHivkS5IM5PfSxboznV/h8huHWawoAFuIWm/:SfHCkS5x5PfSpoDtmYNtAFup6

Score
10/10

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

HacKed

C2

01.92.240.141:5577

Mutex

Windows

Attributes
  • reg_key

    Windows

  • splitter

    |-F-|

Targets

    • Target

      672ac1422873d7481b4d37c1c79b4818a96815cf271b0598ef01bdd9dabe3f74.exe

    • Size

      418KB

    • MD5

      e3ff1e89d54c3469f11b3340c5d83f12

    • SHA1

      1ce54890e5f1a9076c54464527d88cfbb8931b88

    • SHA256

      672ac1422873d7481b4d37c1c79b4818a96815cf271b0598ef01bdd9dabe3f74

    • SHA512

      5814c49ba4e912e71ba7d3d547eefe6cfe485899b8394fd45dad6616a743b55c3a75af9a3e499c936d4bf38b4b08440b7bc20b88ea020769a1b01b9207004c05

    • SSDEEP

      6144:poKALTom4JkwXlGRL0Ybtyf0/47nlX2pMx48yJ15EVToyENhVUPE/f7/QMAezXEZ:pGoB1EL4fD7lX2pI44WNhVUPU/1AOzK

    Score
    10/10
    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

MITRE ATT&CK Enterprise v15

Tasks