General

  • Target

    6b891e0ea4eaccd85e90755915d90e9066646feea730b7fb834887984b81cf93.exe

  • Size

    23KB

  • Sample

    241203-12bwassmaj

  • MD5

    20a31ef8589534ff51715dc0dd0a221a

  • SHA1

    848e661b90295ee198bb137344dd197df4d0f368

  • SHA256

    6b891e0ea4eaccd85e90755915d90e9066646feea730b7fb834887984b81cf93

  • SHA512

    3a1d1ff8bd12888ffc833133a41fce12ab778289d9d799a22067399735b819ef79d2a3645c325eab678d33402d0c45b2447ed5e07bb22f00e60e1c2050129341

  • SSDEEP

    384:wnoWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZI47:17O89p2rRpcnu+7

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

10.10.1.11:5552

Mutex

7657c14284185fbd3fb108b43c7467ba

Attributes
  • reg_key

    7657c14284185fbd3fb108b43c7467ba

  • splitter

    |'|'|

Targets

    • Target

      6b891e0ea4eaccd85e90755915d90e9066646feea730b7fb834887984b81cf93.exe

    • Size

      23KB

    • MD5

      20a31ef8589534ff51715dc0dd0a221a

    • SHA1

      848e661b90295ee198bb137344dd197df4d0f368

    • SHA256

      6b891e0ea4eaccd85e90755915d90e9066646feea730b7fb834887984b81cf93

    • SHA512

      3a1d1ff8bd12888ffc833133a41fce12ab778289d9d799a22067399735b819ef79d2a3645c325eab678d33402d0c45b2447ed5e07bb22f00e60e1c2050129341

    • SSDEEP

      384:wnoWtkEwn65rgjAsGipk55D16xgXakhbZD0mRvR6JZlbw8hqIusZzZI47:17O89p2rRpcnu+7

    • Njrat family

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.