General

  • Target

    New Client.exe

  • Size

    65KB

  • Sample

    241029-scxsgavnfw

  • MD5

    418617925234cf8529050924c905963c

  • SHA1

    d0ee8f492b22dbea6323c8ff0ae8f38b15e68f91

  • SHA256

    6db28dbae5f2b9f2efbb6419a337bbd3c9b98adfe6cafe7a7df946017bbb77f8

  • SHA512

    e81c7d29b57d26bf208f47d48a1119244b3bedaa213138eff2317791dd91b0b7eb77eb9b1f2cb1425a0668d351133acbbb91a9dc5005f22d0482f4b5505fa415

  • SSDEEP

    1536:efqK4Tm4BoN36t4QviFw1AjHkBnvbKfLteF3nLrB9z3nIaF9bHS9vM:efqK4C4BoN36t4QviFC8EBnefWl9zYaL

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

C2

127.0.0.1:36811

Mutex

svhost.exe

Attributes
  • reg_key

    svhost.exe

  • splitter

    |Ghost|

Targets

    • Target

      New Client.exe

    • Size

      65KB

    • MD5

      418617925234cf8529050924c905963c

    • SHA1

      d0ee8f492b22dbea6323c8ff0ae8f38b15e68f91

    • SHA256

      6db28dbae5f2b9f2efbb6419a337bbd3c9b98adfe6cafe7a7df946017bbb77f8

    • SHA512

      e81c7d29b57d26bf208f47d48a1119244b3bedaa213138eff2317791dd91b0b7eb77eb9b1f2cb1425a0668d351133acbbb91a9dc5005f22d0482f4b5505fa415

    • SSDEEP

      1536:efqK4Tm4BoN36t4QviFw1AjHkBnvbKfLteF3nLrB9z3nIaF9bHS9vM:efqK4C4BoN36t4QviFC8EBnefWl9zYaL

    • Njrat family

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks