General

  • Target

    52f95d98c397198874195dec02102c10N.exe

  • Size

    115KB

  • Sample

    240813-g5fh4sybqe

  • MD5

    52f95d98c397198874195dec02102c10

  • SHA1

    956f943f191d5fbb88c74f0b67ffb611f37be9a3

  • SHA256

    b0002ec88fadcd00a830fd35bc2fe38a0a7561cae0750f32a8905454f813cedd

  • SHA512

    983fb448d7bfb9f82b44b32f35492c5f65de8bd1b35ce18e0c6c64944c35b172eb8f6b5b9edf9be056546afeb8a6c304591a045a3a73770c8a4732ba91295580

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDIg:P5eznsjsguGDFqGZ2rDIg

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

C2

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes
  • reg_key

    e1a87040f2026369a233f9ae76301b7b

  • splitter

    |'|'|

Targets

    • Target

      52f95d98c397198874195dec02102c10N.exe

    • Size

      115KB

    • MD5

      52f95d98c397198874195dec02102c10

    • SHA1

      956f943f191d5fbb88c74f0b67ffb611f37be9a3

    • SHA256

      b0002ec88fadcd00a830fd35bc2fe38a0a7561cae0750f32a8905454f813cedd

    • SHA512

      983fb448d7bfb9f82b44b32f35492c5f65de8bd1b35ce18e0c6c64944c35b172eb8f6b5b9edf9be056546afeb8a6c304591a045a3a73770c8a4732ba91295580

    • SSDEEP

      1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDIg:P5eznsjsguGDFqGZ2rDIg

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks