General

  • Target

    7ccd52aa71d10f0d7023b4c30f246d89_JaffaCakes118

  • Size

    43KB

  • Sample

    240528-nlr65aha9t

  • MD5

    7ccd52aa71d10f0d7023b4c30f246d89

  • SHA1

    e0eaa21aa43b34e0b9d0a8ea676a585cc8e7916d

  • SHA256

    afda747854d145b14ad3ec760ffadee413a9f6282f9deecc901bf48e25ea759f

  • SHA512

    458ba9e3b4dc1ee4bb49d41ad6a9926ad412f33b5f5a5fd9f25fea2982c5e1d133cba2b90e7aa97175dd8eea14af92f67de171b4dd6791269ef1852987b3a037

  • SSDEEP

    384:5Zy14DgolYxOoyi08Haf2ASEN8MFQPzgIij+ZsNO3PlpJKkkjh/TzF7pWn5Tgre7:bYouIli04sDP8qwuXQ/oMr+L

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

gazik

C2

127.0.0.1:5552

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      7ccd52aa71d10f0d7023b4c30f246d89_JaffaCakes118

    • Size

      43KB

    • MD5

      7ccd52aa71d10f0d7023b4c30f246d89

    • SHA1

      e0eaa21aa43b34e0b9d0a8ea676a585cc8e7916d

    • SHA256

      afda747854d145b14ad3ec760ffadee413a9f6282f9deecc901bf48e25ea759f

    • SHA512

      458ba9e3b4dc1ee4bb49d41ad6a9926ad412f33b5f5a5fd9f25fea2982c5e1d133cba2b90e7aa97175dd8eea14af92f67de171b4dd6791269ef1852987b3a037

    • SSDEEP

      384:5Zy14DgolYxOoyi08Haf2ASEN8MFQPzgIij+ZsNO3PlpJKkkjh/TzF7pWn5Tgre7:bYouIli04sDP8qwuXQ/oMr+L

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks