General

  • Target

    2dd58cce95b7d839068b45a2263db800N.exe

  • Size

    23KB

  • Sample

    240831-kwn1nswalk

  • MD5

    2dd58cce95b7d839068b45a2263db800

  • SHA1

    699e94b0982dadf77b5594e29e6eb7f8a51ef637

  • SHA256

    392217f642abdb1bb13be435af97db594e32fad2b54beeee0f660dd2bcf1e866

  • SHA512

    64c88c3bca10e207cb499e12e2c111dbb10527af800196e12c31f636c7dd9cc529fac28e09ff1b4b7165bc87d3d33a21ced436af47406ac5fc3434ddbf89225f

  • SSDEEP

    384:loWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZI6:q7O89p2rRpcnug

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

10.10.1.11:5552

Mutex

7657c14284185fbd3fb108b43c7467ba

Attributes
  • reg_key

    7657c14284185fbd3fb108b43c7467ba

  • splitter

    |'|'|

Targets

    • Target

      2dd58cce95b7d839068b45a2263db800N.exe

    • Size

      23KB

    • MD5

      2dd58cce95b7d839068b45a2263db800

    • SHA1

      699e94b0982dadf77b5594e29e6eb7f8a51ef637

    • SHA256

      392217f642abdb1bb13be435af97db594e32fad2b54beeee0f660dd2bcf1e866

    • SHA512

      64c88c3bca10e207cb499e12e2c111dbb10527af800196e12c31f636c7dd9cc529fac28e09ff1b4b7165bc87d3d33a21ced436af47406ac5fc3434ddbf89225f

    • SSDEEP

      384:loWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZI6:q7O89p2rRpcnug

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks