General

  • Target

    85c70c3437ebe4b0b630a653b7a480ab_JaffaCakes118

  • Size

    232KB

  • Sample

    240531-dbhjtsdf94

  • MD5

    85c70c3437ebe4b0b630a653b7a480ab

  • SHA1

    d9466c679bfbfde3a5437d8705cc3bf084a32795

  • SHA256

    c60472bb288cdc3a6f6e3a1b8259cb456946c52ec6c384235aa6f497d3f12e55

  • SHA512

    17a0a917552b45294d50e4f1d0c19515f242f3318da1bb06c74f5201c076b3a7e9df88439ea9ed3081934cbd0e25afeeb45be7dfb251d19487ca388714127a8b

  • SSDEEP

    1536:TXgU1uGxpvZQ7FO6J1xdLr2JTqzUnQJJEXvQduxMM:TXgU1pRQE6J1xmuUnQJuXIdux

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

GOOD

C2

goodattack.ddns.net:7777

Mutex

37c62a0da2f3441cbf32911711ed45e8

Attributes
  • reg_key

    37c62a0da2f3441cbf32911711ed45e8

  • splitter

    |'|'|

Targets

    • Target

      85c70c3437ebe4b0b630a653b7a480ab_JaffaCakes118

    • Size

      232KB

    • MD5

      85c70c3437ebe4b0b630a653b7a480ab

    • SHA1

      d9466c679bfbfde3a5437d8705cc3bf084a32795

    • SHA256

      c60472bb288cdc3a6f6e3a1b8259cb456946c52ec6c384235aa6f497d3f12e55

    • SHA512

      17a0a917552b45294d50e4f1d0c19515f242f3318da1bb06c74f5201c076b3a7e9df88439ea9ed3081934cbd0e25afeeb45be7dfb251d19487ca388714127a8b

    • SSDEEP

      1536:TXgU1uGxpvZQ7FO6J1xdLr2JTqzUnQJJEXvQduxMM:TXgU1pRQE6J1xmuUnQJuXIdux

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Checks whether UAC is enabled

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks