Statik Analiz — NjRAT | ALTO | CVSS: 7.5
Archivo
| SHA256 | b54ee709bc4da31ddaf192d2441806014cb528a9239e7864ba965999b2b50987 |
|---|---|
| MD5 | a20db9a62dee9cec05208b5acaa8cbb4 |
| Archivo | b54ee709bc4da31ddaf192d2441806014cb528a9239e7864ba965999b2b50987.exe |
| Tamaño | 34,826,752 byte |
| Tipo | PE32+ executable for MS Windows 6.01 (GUI), x86-64, 9 sections |
| Stringler | 195,750 |
PDB:
D:\a\_work\1\s\binaries\Win32\Release\pdmui.pdbBölümler
| Ad | Entropi |
|---|---|
.text | 6.24 |
.rdata | 6.3 |
.data | 4.36 |
.pdata | 5.06 |
.xdata | 1.6 |
.idata | 4.08 |
.reloc | 5.4 |
.symtab | 5.09 |
.rsrc | 5.75 |
Import Tablosu
kernel32.dll
IOC
| SHA256 | b54ee709bc4da31ddaf192d2441806014cb528a9239e7864ba965999b2b50987 |
|---|---|
| MD5 | a20db9a62dee9cec05208b5acaa8cbb4 |
| IP | 2.5.29.17, 4.0.0.0, 1.0.0.0, 4.69.1.0, 2.2.0.0, 6.3.0.0, 1.3.6.1, 6.0.0.0 |
| Domain | stem.net, toupperioft.com, comodoca.com, resultpanel.ru, entrust.net, regsql.ru, openxmlformats.org, resourcestrings.ru |
| BTC | 1ActiveDirectoryTransportType |
| Mutex | LpAcquireInstallationMutex, runtime.mutex, get_FileMutex, QAE_NPAVQMutex, QEAA_NPEAVQMutex |
| PDB | D:\a\_work\1\s\binaries\Win32\Release\pdmui.pdb |
| C2 | stem.net, toupperioft.com, comodoca.com, resultpanel.ru, entrust.net |
NjRAT — Perfil del malware
njRAT Bladabindi. Spanish cotizacion lure. get_Panel1 C2 panel. MENA + Latin America targeting.
Tipo de malware
RAT
Lenguaje de programación
VB.NET
Protocolo C2
TCP (varsayilan port 1177)
Sistemas objetivo
Windows
También conocido como (AKA)
Bladabindi, H-Worm, houdini
Detalles técnicos
TCP port 1177 (varsayilan), XOR tabanlı iletisim sifreleme, .NET Framework 2.0+, Mutex: {GUID}, Registry Run key persistence, Keylogger (GetAsyncKeyState), clipboard monitor, screenshot, remote shell, remote camera
Atribución / Actor de amenaza
Arap dilli siber suc topluluklari, en cok MENA (Orta Dogu ve Kuzey Afrika) bolgesindeki gruplar. Yasama savasi donemi Suriyeli gruplar tarafindan da kullanilmistir.
Capacidades y comportamiento
Uzaktan Erişim & Kontrol
Keylogger
Ekran Görüntüsü
Webcam Erişimi
Dosya Yönetimi
Süreç Yönetimi
Komut Yürütme
Kalıcılık Mekanizması
Lista IOC (31 indicadores)
IOC — NjRAT
#
1ActiveDirectoryTransportType
# IP
2.5.29.17
# IP
4.0.0.0
# IP
1.0.0.0
# IP
4.69.1.0
# IP
2.2.0.0
# IP
6.3.0.0
# IP
1.3.6.1
# IP
6.0.0.0
# IP
2.5.29.7
# IP
2.5.4.3
# DOMAIN
stem.net
# DOMAIN
toupperioft.com
# DOMAIN
comodoca.com
# DOMAIN
resultpanel.ru
# DOMAIN
entrust.net
# DOMAIN
regsql.ru
# DOMAIN
openxmlformats.org
# DOMAIN
resourcestrings.ru
# DOMAIN
thawte.com
# DOMAIN
data.ru
# MUTEX
LpAcquireInstallationMutex
# MUTEX
runtime.mutex
# MUTEX
get_FileMutex
# MUTEX
QAE_NPAVQMutex
# MUTEX
QEAA_NPEAVQMutex
# FILEPATH
D:\a\_work\1\s\binaries\Win32\Release\pdmui.pdb
# FILEPATH
D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release\php_com_dotnet.pdb
# FILEPATH
C:\buildslave\unity\build\build\libcache\Library\Bee\artifacts\1900b0aE.dag\Unity.Searcher.Editor.pdb
# FILEPATH
C:\php-snap-build\php74\vc15\x64\obj\Release\php_phpdbg_webhelper.pdb
# FILEPATH
F:\ext\WKR\src\buildtrees\pthreads\x86-windows-webkit-rel\pthreadVC2.pdb
| Tipo | Valor | Nota |
|---|---|---|
| 1ActiveDirectoryTransportType | BTC | |
| ip | 2.5.29.17 | C2 aday |
| ip | 4.0.0.0 | C2 aday |
| ip | 1.0.0.0 | C2 aday |
| ip | 4.69.1.0 | C2 aday |
| ip | 2.2.0.0 | C2 aday |
| ip | 6.3.0.0 | C2 aday |
| ip | 1.3.6.1 | C2 aday |
| ip | 6.0.0.0 | C2 aday |
| ip | 2.5.29.7 | C2 aday |
| ip | 2.5.4.3 | C2 aday |
| domain | stem.net | C2 domain |
| domain | toupperioft.com | C2 domain |
| domain | comodoca.com | C2 domain |
| domain | resultpanel.ru | C2 domain |
| domain | entrust.net | C2 domain |
| domain | regsql.ru | C2 domain |
| domain | openxmlformats.org | C2 domain |
| domain | resourcestrings.ru | C2 domain |
| domain | thawte.com | C2 domain |
| domain | data.ru | C2 domain |
| mutex | LpAcquireInstallationMutex | Mutex |
| mutex | runtime.mutex | Mutex |
| mutex | get_FileMutex | Mutex |
| mutex | QAE_NPAVQMutex | Mutex |
| mutex | QEAA_NPEAVQMutex | Mutex |
| filepath | D:\a\_work\1\s\binaries\Win32\Release\pdmui.pdb | PDB |
| filepath | D:\a\php-ftw\php-ftw\php\vs16\x64\obj\Release\php_com_dotnet.pdb | PDB |
| filepath | C:\buildslave\unity\build\build\libcache\Library\Bee\artifacts\1900b0aE.dag\Unity.Searcher.Editor.pdb | PDB |
| filepath | C:\php-snap-build\php74\vc15\x64\obj\Release\php_phpdbg_webhelper.pdb | PDB |
| filepath | F:\ext\WKR\src\buildtrees\pthreads\x86-windows-webkit-rel\pthreadVC2.pdb | PDB |
Servidores C2 (8 servidores registrados para esta familia)
| Dirección | Tipo | Puerto | Protocolo | Estado | País |
|---|---|---|---|---|---|
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| comodoca.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| comodoca.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
Las direcciones C2 se proporcionan únicamente a partir de muestras de malware verificadas manualmente por el equipo KEYDAL. Se prohíbe el uso comercial.