General

  • Target

    83e901a978502b12b11688d1bf742ef5.exe

  • Size

    654KB

  • Sample

    241004-15r2paygrk

  • MD5

    83e901a978502b12b11688d1bf742ef5

  • SHA1

    92f530bee150a952153bfec430f11ba0e24bea51

  • SHA256

    d6b68928361ae07d5048c8b126efe974f22bf8b311de2d2faee50f18bd28ab9c

  • SHA512

    c8772079caa38a65d4964bb4818d304f13cf5c1f60cea93e4a0a4e501b5885da66abce6ce42603844df0c26fdb7c47dfcf704d77857fa6e8e643c107413268bb

  • SSDEEP

    12288:tqjenzbxpLEGxvMnX3k9bdRWZXeogSBw/7TzJkDEz+tO0cJHK:tq09YYmMSB8z6Qz+kNK

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

encrypted7745.hopto.org:1177

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      83e901a978502b12b11688d1bf742ef5.exe

    • Size

      654KB

    • MD5

      83e901a978502b12b11688d1bf742ef5

    • SHA1

      92f530bee150a952153bfec430f11ba0e24bea51

    • SHA256

      d6b68928361ae07d5048c8b126efe974f22bf8b311de2d2faee50f18bd28ab9c

    • SHA512

      c8772079caa38a65d4964bb4818d304f13cf5c1f60cea93e4a0a4e501b5885da66abce6ce42603844df0c26fdb7c47dfcf704d77857fa6e8e643c107413268bb

    • SSDEEP

      12288:tqjenzbxpLEGxvMnX3k9bdRWZXeogSBw/7TzJkDEz+tO0cJHK:tq09YYmMSB8z6Qz+kNK

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks