General

  • Target

    013aa4e01d67b9b9de9942e2e905d870N

  • Size

    71KB

  • Sample

    240909-qdcgta1hpb

  • MD5

    013aa4e01d67b9b9de9942e2e905d870

  • SHA1

    ef7b47c049d1bce53172c8f9fc48ada8489686ea

  • SHA256

    a9ded12f4c96b9c4db22702ffa75245fd631d05c90473f23b69ca29cd7ef1066

  • SHA512

    7bd8aa4f240a2fd5e1f8d2e31a375ac15f01735c17c5238b3be9c058db0406f0b4b998f244492fde1544b7f6bcbb9faa0cc4cf77618bc4e3a795de7ccfa467f6

  • SSDEEP

    1536:G7sMDnUNaYJGrWDKwsNMDQXExI3pmjm57U:nMDnRCOWDKwsNMDQXExI3pmU7

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

C2

1.0.0.721:81

Mutex

9a0c0a5dbe82ac836b08924925c5d4b1

Attributes
  • reg_key

    9a0c0a5dbe82ac836b08924925c5d4b1

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target

      013aa4e01d67b9b9de9942e2e905d870N

    • Size

      71KB

    • MD5

      013aa4e01d67b9b9de9942e2e905d870

    • SHA1

      ef7b47c049d1bce53172c8f9fc48ada8489686ea

    • SHA256

      a9ded12f4c96b9c4db22702ffa75245fd631d05c90473f23b69ca29cd7ef1066

    • SHA512

      7bd8aa4f240a2fd5e1f8d2e31a375ac15f01735c17c5238b3be9c058db0406f0b4b998f244492fde1544b7f6bcbb9faa0cc4cf77618bc4e3a795de7ccfa467f6

    • SSDEEP

      1536:G7sMDnUNaYJGrWDKwsNMDQXExI3pmjm57U:nMDnRCOWDKwsNMDQXExI3pmU7

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Stops running service(s)

    • Command and Scripting Interpreter: PowerShell

      Using powershell.exe command.

MITRE ATT&CK Enterprise v15

Tasks