General

  • Target

    bca1a5ae15dcd96a52275f594fc5dd6a9727414c7a1b0fc91b09aaa306ea2d57.exe

  • Size

    153KB

  • Sample

    241009-hbrjysyfpl

  • MD5

    bb0d5dce45941d78a9bbbbdbf900d29b

  • SHA1

    afc462d25dc8ec7c7604da71525ef9356b0e8d3e

  • SHA256

    bca1a5ae15dcd96a52275f594fc5dd6a9727414c7a1b0fc91b09aaa306ea2d57

  • SHA512

    8c8e76a38598be099369eea8d6f1b2c84b1b84388685bf4c5860ca54c6e58343bcbc189d567786a0c05290fe3feddeeacc8d096eac0ed46986b9b9ae366a4f03

  • SSDEEP

    3072:d1st4ySHIcCmLvrmVgf43Ks1Vl9ExD+Ze:Tst4FLvrmVS4JL

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

encrypted7745.hopto.org:1177

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      bca1a5ae15dcd96a52275f594fc5dd6a9727414c7a1b0fc91b09aaa306ea2d57.exe

    • Size

      153KB

    • MD5

      bb0d5dce45941d78a9bbbbdbf900d29b

    • SHA1

      afc462d25dc8ec7c7604da71525ef9356b0e8d3e

    • SHA256

      bca1a5ae15dcd96a52275f594fc5dd6a9727414c7a1b0fc91b09aaa306ea2d57

    • SHA512

      8c8e76a38598be099369eea8d6f1b2c84b1b84388685bf4c5860ca54c6e58343bcbc189d567786a0c05290fe3feddeeacc8d096eac0ed46986b9b9ae366a4f03

    • SSDEEP

      3072:d1st4ySHIcCmLvrmVgf43Ks1Vl9ExD+Ze:Tst4FLvrmVS4JL

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks