General

  • Target

    9e9578329532e8f70dd32cd8c06944e0N.exe

  • Size

    114KB

  • Sample

    240822-mljpbavdqk

  • MD5

    9e9578329532e8f70dd32cd8c06944e0

  • SHA1

    e224c9efcbf3d895d13409e2c95f27cc5ec029cc

  • SHA256

    b57c45a06805220749c03932b8854964964b96ed2c0c725521cdc84ab6467e64

  • SHA512

    04d4f2bc3db8982a82e8b033bd4341543ac43b0b7b05a68d906da01b8d0951d504660f97e588491cfbc33a76439190d1c74403abd74d234f26cd19a8afbcac87

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMd1R:P5eznsjsguGDFqGZ2r7R

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

C2

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes
  • reg_key

    e1a87040f2026369a233f9ae76301b7b

  • splitter

    |'|'|

Targets

    • Target

      9e9578329532e8f70dd32cd8c06944e0N.exe

    • Size

      114KB

    • MD5

      9e9578329532e8f70dd32cd8c06944e0

    • SHA1

      e224c9efcbf3d895d13409e2c95f27cc5ec029cc

    • SHA256

      b57c45a06805220749c03932b8854964964b96ed2c0c725521cdc84ab6467e64

    • SHA512

      04d4f2bc3db8982a82e8b033bd4341543ac43b0b7b05a68d906da01b8d0951d504660f97e588491cfbc33a76439190d1c74403abd74d234f26cd19a8afbcac87

    • SSDEEP

      1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMd1R:P5eznsjsguGDFqGZ2r7R

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks