General

  • Target

    7ab9be50e69390506c4ccc32fe58c4e5

  • Size

    186KB

  • Sample

    240127-tztj1afgb2

  • MD5

    7ab9be50e69390506c4ccc32fe58c4e5

  • SHA1

    af4972e56e140762ff2d2162d9ae8f3144fc34cf

  • SHA256

    9de8e8b8966f59a105a3d7d210075bc99535e9ba996946a4bb00f61118c49c92

  • SHA512

    e6227c29444bd26be42bd021b090199033ae5220785f507c1142a0476c9605717ad4958b8318cb6a6c64fe26ee46e54bd57968ddb6cf0e6a068a2a7c605bd252

  • SSDEEP

    3072:xzdKOyuvC6q4+sxv3inZ99urGQFcnzi/fCGJQ4KRCdVsSQ5euzg5hOIEQYuWLX/:FqFnZ99urGQSzDFQdmRg7WQYu2

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

hehe

C2

belabbes312.ddns.net:5552

Mutex

e6b3c2ef14cd98671cd277db95b39125

Attributes
  • reg_key

    e6b3c2ef14cd98671cd277db95b39125

  • splitter

    |'|'|

Targets

    • Target

      7ab9be50e69390506c4ccc32fe58c4e5

    • Size

      186KB

    • MD5

      7ab9be50e69390506c4ccc32fe58c4e5

    • SHA1

      af4972e56e140762ff2d2162d9ae8f3144fc34cf

    • SHA256

      9de8e8b8966f59a105a3d7d210075bc99535e9ba996946a4bb00f61118c49c92

    • SHA512

      e6227c29444bd26be42bd021b090199033ae5220785f507c1142a0476c9605717ad4958b8318cb6a6c64fe26ee46e54bd57968ddb6cf0e6a068a2a7c605bd252

    • SSDEEP

      3072:xzdKOyuvC6q4+sxv3inZ99urGQFcnzi/fCGJQ4KRCdVsSQ5euzg5hOIEQYuWLX/:FqFnZ99urGQSzDFQdmRg7WQYu2

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks