General

  • Target

    8aac74ef8d70805266859d881bd97748

  • Size

    402KB

  • Sample

    240202-17ngaabehm

  • MD5

    8aac74ef8d70805266859d881bd97748

  • SHA1

    a4760dcc8e80b93685a473250713ca18f47051ec

  • SHA256

    47de3e92f52ef60f92bb5b17a23419517f580de69b1051ef00e6eaea1ecabda0

  • SHA512

    bf21505ee93db933708725813710839e4ae7b3335d99e840efd7f1e3f987e38731726e377033be4bf8138bb7fcfaf409be2068e61e35c1073b2b94cf06029ab4

  • SSDEEP

    6144:jmaKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgU:YSmLAuEY71fviagATFmebVQDcYcg

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

pdf

C2

hhhmach.ddns.net:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes
  • reg_key

    5cd8f17f4086744065eb0992a09e05a2

  • splitter

    |'|'|

Targets

    • Target

      8aac74ef8d70805266859d881bd97748

    • Size

      402KB

    • MD5

      8aac74ef8d70805266859d881bd97748

    • SHA1

      a4760dcc8e80b93685a473250713ca18f47051ec

    • SHA256

      47de3e92f52ef60f92bb5b17a23419517f580de69b1051ef00e6eaea1ecabda0

    • SHA512

      bf21505ee93db933708725813710839e4ae7b3335d99e840efd7f1e3f987e38731726e377033be4bf8138bb7fcfaf409be2068e61e35c1073b2b94cf06029ab4

    • SSDEEP

      6144:jmaKVBGmE84IMNv55giU0pKiFYHxfx15RvOagakZBxkTN2gmeGcFnVQb/DAYbDgU:YSmLAuEY71fviagATFmebVQDcYcg

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks