General

  • Target

    New Client.exe

  • Size

    396KB

  • Sample

    240223-r1c8asbb75

  • MD5

    9b5f12b10b471e0a359bc11e50af28db

  • SHA1

    5e42890b6b4a299cd954bf8dabaf75b38522c0b0

  • SHA256

    af34b699b6aa750e58a68516b97b4f8c2f08bd03453a6059f6869847cc63a7bf

  • SHA512

    1fbf71b9121cb141a617a2e14e466fead22da7cc7c672a8e5f79cab929e10a4f578edba06e8340d40d23f51852b33816a67351b6cecf5a5f72410c1bc0d5b773

  • SSDEEP

    12288:+WSeotlIH682B+64kQHam2dNREz9FdOZMJwGuE4QyZom8exsrPR5TE7D0XuDTT:+WSmpL

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:12607

Mutex

Client.exe

Attributes
  • reg_key

    Client.exe

  • splitter

    |Ghost|

Targets

    • Target

      New Client.exe

    • Size

      396KB

    • MD5

      9b5f12b10b471e0a359bc11e50af28db

    • SHA1

      5e42890b6b4a299cd954bf8dabaf75b38522c0b0

    • SHA256

      af34b699b6aa750e58a68516b97b4f8c2f08bd03453a6059f6869847cc63a7bf

    • SHA512

      1fbf71b9121cb141a617a2e14e466fead22da7cc7c672a8e5f79cab929e10a4f578edba06e8340d40d23f51852b33816a67351b6cecf5a5f72410c1bc0d5b773

    • SSDEEP

      12288:+WSeotlIH682B+64kQHam2dNREz9FdOZMJwGuE4QyZom8exsrPR5TE7D0XuDTT:+WSmpL

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks