General

  • Target

    service.exe

  • Size

    48KB

  • Sample

    250118-szg1jawqh1

  • MD5

    98747f5b8125fdbd59f050e30618867f

  • SHA1

    19adbbc70a56d1cefc2f8c60a139e0540affe661

  • SHA256

    0101605928448cc2af7c21ce1f0e701989816fd83c7dc233ca43516427ed8ab7

  • SHA512

    f1356242dd9f56d3606ca3707d1cfddc7bba90cdcd902cc2400255ab63c4608986d249520a7f4c330b11c4b428dbb2468406b7e2b455611c03e8c8dfac6e9aca

  • SSDEEP

    768:tzudimXcTHesAM68IwLXxIICnUErFjeiR5C2w5zP0AMj0OLDKTM/vO0AURXSO:d8LzmBpkrdaJ0Ak5fKY/rfSO

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

PROTHV2

C2

103.253.73.222:711

Mutex

bc537b56da07a3b4870ad823ad802a4a

Attributes
  • reg_key

    bc537b56da07a3b4870ad823ad802a4a

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target

      service.exe

    • Size

      48KB

    • MD5

      98747f5b8125fdbd59f050e30618867f

    • SHA1

      19adbbc70a56d1cefc2f8c60a139e0540affe661

    • SHA256

      0101605928448cc2af7c21ce1f0e701989816fd83c7dc233ca43516427ed8ab7

    • SHA512

      f1356242dd9f56d3606ca3707d1cfddc7bba90cdcd902cc2400255ab63c4608986d249520a7f4c330b11c4b428dbb2468406b7e2b455611c03e8c8dfac6e9aca

    • SSDEEP

      768:tzudimXcTHesAM68IwLXxIICnUErFjeiR5C2w5zP0AMj0OLDKTM/vO0AURXSO:d8LzmBpkrdaJ0Ak5fKY/rfSO

    • Njrat family

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks