General

  • Target

    3621c2d95668ab045e7d618606d699c9.exe

  • Size

    298KB

  • Sample

    240731-fa4f1s1elf

  • MD5

    3621c2d95668ab045e7d618606d699c9

  • SHA1

    2c82b390c927919d8cfe7135d66d76189eac876b

  • SHA256

    4f3b8d1cfa5d84f0eaa63da7af72f0f8d844d2130bdd5324b97d508985bf8748

  • SHA512

    e4de1e5d23cd69c61b5f9a83e06cffc42838f7cedde0a44cf0eb7b785c8f8c24dbecf1d7ab317d25bb69072c0f964d84329d3fd79861538d639aa8649c707b86

  • SSDEEP

    3072:GR94Z8d0RYXzNCanWRsxClDaREaA32oBWYbvAHX:GRC4REKiy

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

复复美制美

C2

hakim32.ddns.net:2000

147.185.221.21:33869

Mutex

5d9b545ac4ee41f57768dba98a8ebbb2

Attributes
  • reg_key

    5d9b545ac4ee41f57768dba98a8ebbb2

  • splitter

    |'|'|

Targets

    • Target

      3621c2d95668ab045e7d618606d699c9.exe

    • Size

      298KB

    • MD5

      3621c2d95668ab045e7d618606d699c9

    • SHA1

      2c82b390c927919d8cfe7135d66d76189eac876b

    • SHA256

      4f3b8d1cfa5d84f0eaa63da7af72f0f8d844d2130bdd5324b97d508985bf8748

    • SHA512

      e4de1e5d23cd69c61b5f9a83e06cffc42838f7cedde0a44cf0eb7b785c8f8c24dbecf1d7ab317d25bb69072c0f964d84329d3fd79861538d639aa8649c707b86

    • SSDEEP

      3072:GR94Z8d0RYXzNCanWRsxClDaREaA32oBWYbvAHX:GRC4REKiy

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Disables Task Manager via registry modification

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks