General

  • Target

    235f0c4a95f3d2c1385a46b80162f25942a7b6042adb57d94953b1516e6a9cd7

  • Size

    1.4MB

  • Sample

    241216-2lf1ratjdk

  • MD5

    00050cc64fda256683a37ead59da6275

  • SHA1

    b7c8995da847d362aed04019bbc123fcf6f4d8b5

  • SHA256

    235f0c4a95f3d2c1385a46b80162f25942a7b6042adb57d94953b1516e6a9cd7

  • SHA512

    ce805c8ee22a2ef33a725406c4c2292693af1cfc5baf6affa9643a94a51e1731d033984d27ca0d3e0f48ffee42ac0b26e5a88c9ee17480bbd5d48dc6d0aaeec7

  • SSDEEP

    24576:z1D1e9OI2aniISdRwENQzIAKoMC+VMPVK1nzS9eno8YdOwdY:/pIziJ4IjbePVgn4d

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

blood-modeling.gl.at.ply.gg:5296

Mutex

e7cf38de5b69a1d5ad968db32e781979

Attributes
  • reg_key

    e7cf38de5b69a1d5ad968db32e781979

  • splitter

    |'|'|

Targets

    • Target

      235f0c4a95f3d2c1385a46b80162f25942a7b6042adb57d94953b1516e6a9cd7

    • Size

      1.4MB

    • MD5

      00050cc64fda256683a37ead59da6275

    • SHA1

      b7c8995da847d362aed04019bbc123fcf6f4d8b5

    • SHA256

      235f0c4a95f3d2c1385a46b80162f25942a7b6042adb57d94953b1516e6a9cd7

    • SHA512

      ce805c8ee22a2ef33a725406c4c2292693af1cfc5baf6affa9643a94a51e1731d033984d27ca0d3e0f48ffee42ac0b26e5a88c9ee17480bbd5d48dc6d0aaeec7

    • SSDEEP

      24576:z1D1e9OI2aniISdRwENQzIAKoMC+VMPVK1nzS9eno8YdOwdY:/pIziJ4IjbePVgn4d

    • Njrat family

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Modifies Windows Firewall

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Drops startup file

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Legitimate hosting services abused for malware hosting/C2

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.