General

  • Target

    91ce9d9d01ed7632befdb10cc87000c432a5ed93781a0e317375d643deb7fdce

  • Size

    114KB

  • Sample

    240811-af1dnazcjh

  • MD5

    6a926b692d4e7626193420eb611a7be2

  • SHA1

    a117228eaaab2a15d41de64c307541be5fdc979c

  • SHA256

    91ce9d9d01ed7632befdb10cc87000c432a5ed93781a0e317375d643deb7fdce

  • SHA512

    baf3ed027b8d621cdadf9cbd6ef7be9b1af50bc021ed8ead76dd94e278f5147bc83cb8600b8b0a51bc0df3a34162c8d260a09533c4890a70b5b8aad3dc45ae73

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMdeL:P5eznsjsguGDFqGZ2rq

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

C2

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes
  • reg_key

    e1a87040f2026369a233f9ae76301b7b

  • splitter

    |'|'|

Targets

    • Target

      91ce9d9d01ed7632befdb10cc87000c432a5ed93781a0e317375d643deb7fdce

    • Size

      114KB

    • MD5

      6a926b692d4e7626193420eb611a7be2

    • SHA1

      a117228eaaab2a15d41de64c307541be5fdc979c

    • SHA256

      91ce9d9d01ed7632befdb10cc87000c432a5ed93781a0e317375d643deb7fdce

    • SHA512

      baf3ed027b8d621cdadf9cbd6ef7be9b1af50bc021ed8ead76dd94e278f5147bc83cb8600b8b0a51bc0df3a34162c8d260a09533c4890a70b5b8aad3dc45ae73

    • SSDEEP

      1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMdeL:P5eznsjsguGDFqGZ2rq

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks