General

  • Target

    aa60573d3d1a56190858edb2df0344b9d1082f0eae840004941a1d6b30a1b804

  • Size

    405KB

  • Sample

    240227-2zv2tsdg51

  • MD5

    3c3d7dcdc0c4eb7dd9db090c60867a1e

  • SHA1

    19d81e94000e24afb6f63ef7e3456a01cc884f30

  • SHA256

    aa60573d3d1a56190858edb2df0344b9d1082f0eae840004941a1d6b30a1b804

  • SHA512

    aa2b2e432539124cba4f3443f3b24fd0f9d6c5e56aadf990c44dfcebd13692e15ec72fabb10cf4f55aa0227bf159c19cc45240dda1ca95fbda36ae9d8a2d5bb6

  • SSDEEP

    6144:gxj7phR7li/HN9K2iZQbZc3Plf/muQuu3f8QsEdSGTYe0i82TFpjVvxD43y8v3nj:Su/t9KzZscMuPuP8ZEVE4FXjDX8vU8

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

2.tcp.eu.ngrok.io:15020

Mutex

4e9daa30b38fc305bea41b41415459d5

Attributes
  • reg_key

    4e9daa30b38fc305bea41b41415459d5

  • splitter

    |'|'|

Targets

    • Target

      aa60573d3d1a56190858edb2df0344b9d1082f0eae840004941a1d6b30a1b804

    • Size

      405KB

    • MD5

      3c3d7dcdc0c4eb7dd9db090c60867a1e

    • SHA1

      19d81e94000e24afb6f63ef7e3456a01cc884f30

    • SHA256

      aa60573d3d1a56190858edb2df0344b9d1082f0eae840004941a1d6b30a1b804

    • SHA512

      aa2b2e432539124cba4f3443f3b24fd0f9d6c5e56aadf990c44dfcebd13692e15ec72fabb10cf4f55aa0227bf159c19cc45240dda1ca95fbda36ae9d8a2d5bb6

    • SSDEEP

      6144:gxj7phR7li/HN9K2iZQbZc3Plf/muQuu3f8QsEdSGTYe0i82TFpjVvxD43y8v3nj:Su/t9KzZscMuPuP8ZEVE4FXjDX8vU8

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Executes dropped EXE

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks