General

  • Target

    ab4732bf791e42716a74276901601faa

  • Size

    4.8MB

  • Sample

    240228-hqdlmsdg5x

  • MD5

    ab4732bf791e42716a74276901601faa

  • SHA1

    0d29d6e42b56533db20a5c8f6c6bc85d0a8c2836

  • SHA256

    7c6df9095c974d5e5991cca2dc49cc526eb44d4154edf20b0a5eea1611e7381c

  • SHA512

    21bf321e0e0bb3733c58055f45a07b099fd3bd9f58ac691798ed57aad6ed74348914f329f5fad5e7e063956703a2279829657f8493102e8e17d1069e9adeb5a9

  • SSDEEP

    49152:9gdp7GF84giXxMQg3Q3cX5C/wnvdAlPjcmY6PZUUn0VdCqlFEK4tJ+CdHGc:mcF84gi3xULNIDdmc

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

4fe16ee437a4b36f3e1a6566414955aa

Attributes
  • reg_key

    4fe16ee437a4b36f3e1a6566414955aa

  • splitter

    |'|'|

Targets

    • Target

      ab4732bf791e42716a74276901601faa

    • Size

      4.8MB

    • MD5

      ab4732bf791e42716a74276901601faa

    • SHA1

      0d29d6e42b56533db20a5c8f6c6bc85d0a8c2836

    • SHA256

      7c6df9095c974d5e5991cca2dc49cc526eb44d4154edf20b0a5eea1611e7381c

    • SHA512

      21bf321e0e0bb3733c58055f45a07b099fd3bd9f58ac691798ed57aad6ed74348914f329f5fad5e7e063956703a2279829657f8493102e8e17d1069e9adeb5a9

    • SSDEEP

      49152:9gdp7GF84giXxMQg3Q3cX5C/wnvdAlPjcmY6PZUUn0VdCqlFEK4tJ+CdHGc:mcF84gi3xULNIDdmc

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks