General

  • Target

    f25c2fc70eca513112ecafde460ebd95f18a8fac38b219109e0dcf0a81cebf16

  • Size

    117KB

  • Sample

    241202-erfwlsypg1

  • MD5

    fda7c672fb826156ead78ef2d53ea576

  • SHA1

    0984be1198abeed4f259fcb8f69304fc6bbc849c

  • SHA256

    f25c2fc70eca513112ecafde460ebd95f18a8fac38b219109e0dcf0a81cebf16

  • SHA512

    a4711c99f1c9e51c911ddfc75e5f7914625afbd3713b4ab41ec3948b2911a57204677bc71af3612c3393cb47ed852e74dbe5c1ecf9aeb47e4a94ce45d77914ad

  • SSDEEP

    1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDLVgO:P5eznsjsguGDFqGZ2rDL7

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

neuf

C2

doddyfire.linkpc.net:10000

Mutex

e1a87040f2026369a233f9ae76301b7b

Attributes
  • reg_key

    e1a87040f2026369a233f9ae76301b7b

  • splitter

    |'|'|

Targets

    • Target

      f25c2fc70eca513112ecafde460ebd95f18a8fac38b219109e0dcf0a81cebf16

    • Size

      117KB

    • MD5

      fda7c672fb826156ead78ef2d53ea576

    • SHA1

      0984be1198abeed4f259fcb8f69304fc6bbc849c

    • SHA256

      f25c2fc70eca513112ecafde460ebd95f18a8fac38b219109e0dcf0a81cebf16

    • SHA512

      a4711c99f1c9e51c911ddfc75e5f7914625afbd3713b4ab41ec3948b2911a57204677bc71af3612c3393cb47ed852e74dbe5c1ecf9aeb47e4a94ce45d77914ad

    • SSDEEP

      1536:WWp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4XEQhuxzuMDLVgO:P5eznsjsguGDFqGZ2rDL7

    • Njrat family

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.