General

  • Target

    1cd657fbab02d949326cc0d174b2d3909fa32cd4c53592ae530ff33379528498.exe

  • Size

    43KB

  • Sample

    241212-ckfadswqc1

  • MD5

    831391429d50f54bdad48209d87e7370

  • SHA1

    8feb1f6f7df7863eb6aa711d952f4ac85f2d97f3

  • SHA256

    1cd657fbab02d949326cc0d174b2d3909fa32cd4c53592ae530ff33379528498

  • SHA512

    d19fc494de57e02f18162d7056cb93b7431dff4315d1300e9d1b6e9b95a8fa0d96a378a6896d1f0d604e17c4b55b3f72c90781d9bc1482e649d4c7d4fcc63dbc

  • SSDEEP

    384:1ZyZcg98NaIyrtdd32E68ETiE7QzsIij+ZsNO3PlpJKkkjh/TzF7pWnYmgreT0pO:f4ywFrLd32HfquXQ/oRC+L

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

4.tcp.eu.ngrok.io:16948

Mutex

Windows Update

Attributes
  • reg_key

    Windows Update

  • splitter

    |Hassan|

Targets

    • Target

      1cd657fbab02d949326cc0d174b2d3909fa32cd4c53592ae530ff33379528498.exe

    • Size

      43KB

    • MD5

      831391429d50f54bdad48209d87e7370

    • SHA1

      8feb1f6f7df7863eb6aa711d952f4ac85f2d97f3

    • SHA256

      1cd657fbab02d949326cc0d174b2d3909fa32cd4c53592ae530ff33379528498

    • SHA512

      d19fc494de57e02f18162d7056cb93b7431dff4315d1300e9d1b6e9b95a8fa0d96a378a6896d1f0d604e17c4b55b3f72c90781d9bc1482e649d4c7d4fcc63dbc

    • SSDEEP

      384:1ZyZcg98NaIyrtdd32E68ETiE7QzsIij+ZsNO3PlpJKkkjh/TzF7pWnYmgreT0pO:f4ywFrLd32HfquXQ/oRC+L

    • Njrat family

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks