General
-
Target
https://sites.google.com/view/exlaunch2/
-
Sample
241217-qvgsvszqcv
Score
10/10
Malware Config
Extracted
Family
njrat
Version
0.7d
Botnet
HacKed
C2
hakim32.ddns.net:2000
127.0.0.1:5552
Mutex
85623461720a6d2cdfc5925563d264c4
Attributes
-
reg_key
85623461720a6d2cdfc5925563d264c4
-
splitter
|'|'|
Targets
-
-
Target
https://sites.google.com/view/exlaunch2/
Score10/10-
Njrat family
-
njRAT/Bladabindi
Widely used RAT written in .NET.
-
Downloads MZ/PE file
-
Modifies Windows Firewall
-
A potential corporate email address has been identified in the URL: ExL@µnch3.zip
-
Executes dropped EXE
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Legitimate hosting services abused for malware hosting/C2
-
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Subvert Trust Controls
1SIP and Trust Provider Hijacking
1