General

  • Target

    084c0f8aafbde2d2e5d44b047c1f66f0_JaffaCakes118

  • Size

    23KB

  • Sample

    240429-wrgxcagh96

  • MD5

    084c0f8aafbde2d2e5d44b047c1f66f0

  • SHA1

    5b334182b61945930d3aec8f8e6b85de1c95c89a

  • SHA256

    3b594bd95c055618134c06d33dff737182711c48e365f259f17447ff63e0f34e

  • SHA512

    1bafb304196a2e46ca367294897f9e68b92f5351b440ee7326011bfc5dbc27179395d705572861b630e2c8c8e9be37a8f49e2d87d1749191b26ac43475cc4a82

  • SSDEEP

    384:nwTSiYWD2Z7w3CsJeiecwJ3fw6FgzeAh33RtmRvR6JZlbw8hqIusZzZLf:6vZiBK1edJRpcnus

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

VALORANT !!!!!!!!

C2

fnhost1.ddns.net:1111

Mutex

8ec50ac2e8ab9858759604dab647032d

Attributes
  • reg_key

    8ec50ac2e8ab9858759604dab647032d

  • splitter

    |'|'|

Targets

    • Target

      084c0f8aafbde2d2e5d44b047c1f66f0_JaffaCakes118

    • Size

      23KB

    • MD5

      084c0f8aafbde2d2e5d44b047c1f66f0

    • SHA1

      5b334182b61945930d3aec8f8e6b85de1c95c89a

    • SHA256

      3b594bd95c055618134c06d33dff737182711c48e365f259f17447ff63e0f34e

    • SHA512

      1bafb304196a2e46ca367294897f9e68b92f5351b440ee7326011bfc5dbc27179395d705572861b630e2c8c8e9be37a8f49e2d87d1749191b26ac43475cc4a82

    • SSDEEP

      384:nwTSiYWD2Z7w3CsJeiecwJ3fw6FgzeAh33RtmRvR6JZlbw8hqIusZzZLf:6vZiBK1edJRpcnus

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks