| Hash / Info | Value |
|---|---|
| SHA256 | bd23dea9295ebf3783b8c958723800308f6a77c3e059319af0b9ce0b2f67cb2a |
| MD5 | b6cd4e4db2bad7fefd0513360d022a26 |
| SHA1 | 73544765195bf3afd2df451ac9ef984a624fa458 |
| File Adi | Setup_MT_V14.6865.msi |
| File Type | msi |
| Size | 1,208,320 bytes |
| First Seen | 2026-03-30 |
Tehdit Valuelendirmesi
Bu ornek, saldırganlara ele gecirilen sistemler uzerinde tam uzaktan kontrol imkani sunan bir RAT (Uzaktan Erisim Trojanı) olarak tespit edilmistir. Keylogging, ekran goruntüsü alma, dosya yonetimi ve kabuk erisimi gibi kapsamlı gozetleme yeteneklerine sahiptir.
Detected Capabilities
- Uzaktan Erisim
- Keylogging
- Ekran Goruntüsü
- File Yonetimi
- Kabuk Erisimi
MalwareBazaar Tags
Analysis Note
Bu ornek NjRAT ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.
NjRAT — Malware Profile
njRAT Bladabindi. Spanish cotizacion lure. get_Panel1 C2 panel. MENA + Latin America targeting.
Technical Details
TCP port 1177 (varsayilan), XOR tabanlı iletisim sifreleme, .NET Framework 2.0+, Mutex: {GUID}, Registry Run key persistence, Keylogger (GetAsyncKeyState), clipboard monitor, screenshot, remote shell, remote camera
Attribution / Threat Actor
Arap dilli siber suc topluluklari, en cok MENA (Orta Dogu ve Kuzey Afrika) bolgesindeki gruplar. Yasama savasi donemi Suriyeli gruplar tarafindan da kullanilmistir.
Capabilities & Behavior
IOC List (2 indicators)
# SHA256
bd23dea9295ebf3783b8c958723800308f6a77c3e059319af0b9ce0b2f67cb2a
# MD5
b6cd4e4db2bad7fefd0513360d022a26
| Type | Value | Note |
|---|---|---|
| sha256 | bd23dea9295ebf3783b8c958723800308f6a77c3e059319af0b9ce0b2f67cb2a | |
| md5 | b6cd4e4db2bad7fefd0513360d022a26 |
C2 Servers (8 recorded servers for this family)
| Address | Type | Port | Protocol | Status | Country |
|---|---|---|---|---|---|
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| comodoca.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| comodoca.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.