General

  • Target

    ش.exe

  • Size

    54KB

  • Sample

    241203-yg4z8swnck

  • MD5

    28b81b2414715f54bf8bcbf3e234f209

  • SHA1

    180236b9ccde63c3b7f5b4614d70bf1a477fc156

  • SHA256

    f22f497f6423a7c5a4a7c8e3c68b29a6da25c8d533c1282e51d4c1a53f99a2a5

  • SHA512

    cd0085471d38035c4d769d1c3303333859a1cd86a81a051c38d86171039ba768de2dd06cf92e28adc7a8f833bffd14ca129ef7434088a5e736d098a7a7ba4081

  • SSDEEP

    768:3w+NRCat1ManMLF2N+bcs3S3kgkSNImwFvfu0YMDHPsAL7XJSxI3pmNm:3X2oDnZN+bcsCJDtwsNMD7XExI3pmNm

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

fucked by kev

C2

activities-consist.gl.at.ply:16814

Mutex

f41ec467eb2379368a783132943892c6

Attributes
  • reg_key

    f41ec467eb2379368a783132943892c6

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target

      ش.exe

    • Size

      54KB

    • MD5

      28b81b2414715f54bf8bcbf3e234f209

    • SHA1

      180236b9ccde63c3b7f5b4614d70bf1a477fc156

    • SHA256

      f22f497f6423a7c5a4a7c8e3c68b29a6da25c8d533c1282e51d4c1a53f99a2a5

    • SHA512

      cd0085471d38035c4d769d1c3303333859a1cd86a81a051c38d86171039ba768de2dd06cf92e28adc7a8f833bffd14ca129ef7434088a5e736d098a7a7ba4081

    • SSDEEP

      768:3w+NRCat1ManMLF2N+bcs3S3kgkSNImwFvfu0YMDHPsAL7XJSxI3pmNm:3X2oDnZN+bcsCJDtwsNMD7XExI3pmNm

    • Njrat family

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Drops startup file

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks