General

  • Target

    1a88e9189f548c9e8c9f6f8063d54693.exe

  • Size

    296KB

  • Sample

    240625-13dfhswglc

  • MD5

    9c28f2f61986e88ad962a005ef9d983e

  • SHA1

    75ac8970807b4440b155a0ee48fcd0ec133f12f3

  • SHA256

    2d2298fcea04fd70ff1ba16c097ff2dbf036c99a56dbd336b03ced7323de8ba3

  • SHA512

    2283d38ded2fb7274119f2d8a7fea303f7f41f4fb0e8041cba0023e876ec27bbf8306171e3bf09a6c1758b022e9581b0eeb5b393117a17b73e503107bf47d3ba

  • SSDEEP

    3072:XSDwEIu5+fMAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZk:XSsfM+GIIIIIIIhIIIIIIIIIIIIIIIU

Malware Config

Extracted

Family

njrat

Botnet

Hacked By HiDDen PerSOn

Mutex

1a88e9189f548c9e8c9f6f8063d54693

Attributes
  • reg_key

    1a88e9189f548c9e8c9f6f8063d54693

Targets

    • Target

      1a88e9189f548c9e8c9f6f8063d54693.exe

    • Size

      296KB

    • MD5

      9c28f2f61986e88ad962a005ef9d983e

    • SHA1

      75ac8970807b4440b155a0ee48fcd0ec133f12f3

    • SHA256

      2d2298fcea04fd70ff1ba16c097ff2dbf036c99a56dbd336b03ced7323de8ba3

    • SHA512

      2283d38ded2fb7274119f2d8a7fea303f7f41f4fb0e8041cba0023e876ec27bbf8306171e3bf09a6c1758b022e9581b0eeb5b393117a17b73e503107bf47d3ba

    • SSDEEP

      3072:XSDwEIu5+fMAZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZZ+ZZZZZZZZZZZZZZZZk:XSsfM+GIIIIIIIhIIIIIIIIIIIIIIIU

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks