General

  • Target

    1ee14a0ceae448ba0f7f6d8087c4f3bfd1a780def8743cee939e8341da7dc25a

  • Size

    111KB

  • Sample

    240810-x7vzksycrg

  • MD5

    94db40a0b57835be3efcc9127c6f083a

  • SHA1

    72f41f159842118a351d26e65dbb7771556caa27

  • SHA256

    1ee14a0ceae448ba0f7f6d8087c4f3bfd1a780def8743cee939e8341da7dc25a

  • SHA512

    ed53c47699bc0b191893c27a444e547d2581a7791d038b4dbfb4f7143b4871446c387363977488d22a5c832acfd5602096870e8b8787b3938379d2905335a09f

  • SSDEEP

    1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBh73g:w5eznsjsguGDFqGx8egoxmO3rg

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

C2

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes
  • reg_key

    e1a87040f2026369a233f9ae76301b7b

  • splitter

    |'|'|

Targets

    • Target

      1ee14a0ceae448ba0f7f6d8087c4f3bfd1a780def8743cee939e8341da7dc25a

    • Size

      111KB

    • MD5

      94db40a0b57835be3efcc9127c6f083a

    • SHA1

      72f41f159842118a351d26e65dbb7771556caa27

    • SHA256

      1ee14a0ceae448ba0f7f6d8087c4f3bfd1a780def8743cee939e8341da7dc25a

    • SHA512

      ed53c47699bc0b191893c27a444e547d2581a7791d038b4dbfb4f7143b4871446c387363977488d22a5c832acfd5602096870e8b8787b3938379d2905335a09f

    • SSDEEP

      1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBh73g:w5eznsjsguGDFqGx8egoxmO3rg

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks