General

  • Target

    Bootstrapper.exe

  • Size

    37KB

  • Sample

    241113-rr2jjatcnc

  • MD5

    e08d7967557238a0ee488e405f7865dd

  • SHA1

    b4428239dff65be117076a6d2169c1f5488e098e

  • SHA256

    3ba9088ef4662608ccdb45a1333d4a5c9970fa90acdfdff4787233b8e4aa23d4

  • SHA512

    f9d197250afbdffb9d7081f87b94687d1cd7d53f7901e0b402444f5e8f9c9df76b8b1ff25d44246231468de3a13bfa5b0d61755bd341bac191bef7ba0d51da81

  • SSDEEP

    384:71/yi00nCVpd3vVmyhKrrvFcCRYc2/efurAF+rMRTyN/0L+EcoinblneHQM3epzR:xHANVdhKr7FcRB/eWrM+rMRa8NuGItN

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

Krasus-Pc

C2

mingrelian.duckdns.org:4444

Mutex

cf0442d73ab4fa4b3573bef8feb3ee75

Attributes
  • reg_key

    cf0442d73ab4fa4b3573bef8feb3ee75

  • splitter

    |'|'|

Targets

    • Target

      Bootstrapper.exe

    • Size

      37KB

    • MD5

      e08d7967557238a0ee488e405f7865dd

    • SHA1

      b4428239dff65be117076a6d2169c1f5488e098e

    • SHA256

      3ba9088ef4662608ccdb45a1333d4a5c9970fa90acdfdff4787233b8e4aa23d4

    • SHA512

      f9d197250afbdffb9d7081f87b94687d1cd7d53f7901e0b402444f5e8f9c9df76b8b1ff25d44246231468de3a13bfa5b0d61755bd341bac191bef7ba0d51da81

    • SSDEEP

      384:71/yi00nCVpd3vVmyhKrrvFcCRYc2/efurAF+rMRTyN/0L+EcoinblneHQM3epzR:xHANVdhKr7FcRB/eWrM+rMRa8NuGItN

    • Njrat family

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops autorun.inf file

      Malware can abuse Windows Autorun to spread further via attached volumes.

MITRE ATT&CK Enterprise v15

Tasks