General

  • Target

    cc15a4328fd432864596951111205eac_JaffaCakes118

  • Size

    9.8MB

  • Sample

    240831-cxlyps1aqd

  • MD5

    cc15a4328fd432864596951111205eac

  • SHA1

    f06bbeae34ede64c58bf3304320bdc722a6f672c

  • SHA256

    fb600ea4c6c05fcd6ad853d797541fe97b5af09c0bdc76591974585900f334fe

  • SHA512

    bb9132323bd2b268ae346a1ada9238dba13cd00e2e1d372bde277aff37ca253a695215d1daea93fd7587943fcd410c51c4010e29060497d0374dfaf2395081ed

  • SSDEEP

    196608:Gviq75/TzufgxZx4aMkCl+6UYEo0BPZuPTC9W9CPqOvLr6No:OiC/Rjck96UYE5Bcp9CPq4+i

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

192.168.0.96:228

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      cc15a4328fd432864596951111205eac_JaffaCakes118

    • Size

      9.8MB

    • MD5

      cc15a4328fd432864596951111205eac

    • SHA1

      f06bbeae34ede64c58bf3304320bdc722a6f672c

    • SHA256

      fb600ea4c6c05fcd6ad853d797541fe97b5af09c0bdc76591974585900f334fe

    • SHA512

      bb9132323bd2b268ae346a1ada9238dba13cd00e2e1d372bde277aff37ca253a695215d1daea93fd7587943fcd410c51c4010e29060497d0374dfaf2395081ed

    • SSDEEP

      196608:Gviq75/TzufgxZx4aMkCl+6UYEo0BPZuPTC9W9CPqOvLr6No:OiC/Rjck96UYE5Bcp9CPq4+i

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of NtSetInformationThreadHideFromDebugger

MITRE ATT&CK Enterprise v15

Tasks