General

  • Target

    de29917b184e235fac0d0d296656703bc07d95f6469a13cb41a7e38e51414902

  • Size

    117KB

  • Sample

    240801-f4rdjstgkr

  • MD5

    b55cef0497761d472c65d984d79a859e

  • SHA1

    6ac3b5e313312e372eb8362d93b88e7628a7ff1d

  • SHA256

    de29917b184e235fac0d0d296656703bc07d95f6469a13cb41a7e38e51414902

  • SHA512

    02b9d51acbde8f0ed6ea0432849b25b7a15a4ab5cfd59a8f4a1ed67616b478910a6bb819c393c008d12fbaac52861a289aa96ce2c90b38364f449de8af79b6d7

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDLZl+Z:P5eznsjsguGDFqGZ2rDLOZ

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

C2

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes
  • reg_key

    e1a87040f2026369a233f9ae76301b7b

  • splitter

    |'|'|

Targets

    • Target

      de29917b184e235fac0d0d296656703bc07d95f6469a13cb41a7e38e51414902

    • Size

      117KB

    • MD5

      b55cef0497761d472c65d984d79a859e

    • SHA1

      6ac3b5e313312e372eb8362d93b88e7628a7ff1d

    • SHA256

      de29917b184e235fac0d0d296656703bc07d95f6469a13cb41a7e38e51414902

    • SHA512

      02b9d51acbde8f0ed6ea0432849b25b7a15a4ab5cfd59a8f4a1ed67616b478910a6bb819c393c008d12fbaac52861a289aa96ce2c90b38364f449de8af79b6d7

    • SSDEEP

      1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDLZl+Z:P5eznsjsguGDFqGZ2rDLOZ

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks