General

  • Target

    d422eaabc8ad234cbfe79ef20dbbd6386fa5a367c9da869a33cac7379830a6d7.exe

  • Size

    31KB

  • Sample

    240523-ch1hjsaa73

  • MD5

    d16886dc04d9ce85c604088c886b8fd5

  • SHA1

    49653245efb1cfe5eee9b3452bb83c6718ba5c2f

  • SHA256

    d422eaabc8ad234cbfe79ef20dbbd6386fa5a367c9da869a33cac7379830a6d7

  • SHA512

    b1bfa78a37e9e8a957c8ff4203f607e952dfa46e0ff3d22706e0d3d44c10f60a2f24f73559d63c5ad919b06b71920b79f8c6b4fad92d57ff8e49c9732f2f82fc

  • SSDEEP

    768:njMXjwpJbb2zxxO56eqvPisfv8yQmIDUu0tiWmj:ikKdisvQVkQj

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

upss

C2

4.tcp.eu.ngrok.io:17748

Mutex

406e946763c60aa214f9df290a7f9ffa

Attributes
  • reg_key

    406e946763c60aa214f9df290a7f9ffa

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target

      d422eaabc8ad234cbfe79ef20dbbd6386fa5a367c9da869a33cac7379830a6d7.exe

    • Size

      31KB

    • MD5

      d16886dc04d9ce85c604088c886b8fd5

    • SHA1

      49653245efb1cfe5eee9b3452bb83c6718ba5c2f

    • SHA256

      d422eaabc8ad234cbfe79ef20dbbd6386fa5a367c9da869a33cac7379830a6d7

    • SHA512

      b1bfa78a37e9e8a957c8ff4203f607e952dfa46e0ff3d22706e0d3d44c10f60a2f24f73559d63c5ad919b06b71920b79f8c6b4fad92d57ff8e49c9732f2f82fc

    • SSDEEP

      768:njMXjwpJbb2zxxO56eqvPisfv8yQmIDUu0tiWmj:ikKdisvQVkQj

    Score
    10/10
    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks