General

  • Target

    a8d62a69ba433b8122c070da9010d4a2

  • Size

    212KB

  • Sample

    240227-lp3e6ade84

  • MD5

    a8d62a69ba433b8122c070da9010d4a2

  • SHA1

    8b3828d311b7a5598bc51197854fa8c1eac66af5

  • SHA256

    364efa474c8f3973072c2fa86c8ebe4752cacae6c20e1204d10bcb5a1e3497d1

  • SHA512

    7f7ac32458243c3bbb5f3fd7a122dc926e8647703a027e3ba6ec2838a4789b980a90e068723aa8d03d21494a147a1b14be41f229082093f5d4fd1bf70ab83bc1

  • SSDEEP

    3072:lJacj8v7wQ+ZGx7w8wjjP8I1IU8RjrzzvUWAOZjfKdLnYP:lJPgv7wJZ87wBjYI1IUwrIOZyYP

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

Hacked

C2

abdo95.ddns.net:1177

Mutex

ed6e2bf930f6d35b3ac57c049d10ac2c

Attributes
  • reg_key

    ed6e2bf930f6d35b3ac57c049d10ac2c

  • splitter

    |'|'|

Targets

    • Target

      a8d62a69ba433b8122c070da9010d4a2

    • Size

      212KB

    • MD5

      a8d62a69ba433b8122c070da9010d4a2

    • SHA1

      8b3828d311b7a5598bc51197854fa8c1eac66af5

    • SHA256

      364efa474c8f3973072c2fa86c8ebe4752cacae6c20e1204d10bcb5a1e3497d1

    • SHA512

      7f7ac32458243c3bbb5f3fd7a122dc926e8647703a027e3ba6ec2838a4789b980a90e068723aa8d03d21494a147a1b14be41f229082093f5d4fd1bf70ab83bc1

    • SSDEEP

      3072:lJacj8v7wQ+ZGx7w8wjjP8I1IU8RjrzzvUWAOZjfKdLnYP:lJPgv7wJZ87wBjYI1IUwrIOZyYP

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks