| Hash / Info | Value |
|---|---|
| SHA256 | e1f464e1e64b37b5560140b9489c61c52c9f5e342ce70a857e58eb514895b126 |
| MD5 | ba5e59b6fab03b955559e0c0f8c74f91 |
| SHA1 | db39c060d8eb3f7c66318518f51e41a9f3840436 |
| File Adi | e1f464e1e64b37b5560140b9489c61c52c9f5e342ce70a857e58eb514895b126 |
| File Type | msi |
| Size | 1,191,936 bytes |
| First Seen | 2026-03-25 |
Tehdit Valuelendirmesi
Bu ornek, saldırganlara ele gecirilen sistemler uzerinde tam uzaktan kontrol imkani sunan bir RAT (Uzaktan Erisim Trojanı) olarak tespit edilmistir. Keylogging, ekran goruntüsü alma, dosya yonetimi ve kabuk erisimi gibi kapsamlı gozetleme yeteneklerine sahiptir.
Detected Capabilities
- Uzaktan Erisim
- Keylogging
- Ekran Goruntüsü
- File Yonetimi
- Kabuk Erisimi
MalwareBazaar Tags
Analysis Note
Bu ornek NjRAT ailesine ait ve MalwareBazaar platformundan alınmıstır. KEYDAL Guvenlik Arastirmaları tarafından metadata analizi gerceklestirilmis ve IOC veritabanına eklenmistir.
NjRAT — Malware Profile
njRAT Bladabindi. Spanish cotizacion lure. get_Panel1 C2 panel. MENA + Latin America targeting.
Technical Details
TCP port 1177 (varsayilan), XOR tabanlı iletisim sifreleme, .NET Framework 2.0+, Mutex: {GUID}, Registry Run key persistence, Keylogger (GetAsyncKeyState), clipboard monitor, screenshot, remote shell, remote camera
Attribution / Threat Actor
Arap dilli siber suc topluluklari, en cok MENA (Orta Dogu ve Kuzey Afrika) bolgesindeki gruplar. Yasama savasi donemi Suriyeli gruplar tarafindan da kullanilmistir.
Capabilities & Behavior
IOC List (2 indicators)
# SHA256
e1f464e1e64b37b5560140b9489c61c52c9f5e342ce70a857e58eb514895b126
# MD5
ba5e59b6fab03b955559e0c0f8c74f91
| Type | Value | Note |
|---|---|---|
| sha256 | e1f464e1e64b37b5560140b9489c61c52c9f5e342ce70a857e58eb514895b126 | |
| md5 | ba5e59b6fab03b955559e0c0f8c74f91 |
C2 Servers (8 recorded servers for this family)
| Address | Type | Port | Protocol | Status | Country |
|---|---|---|---|---|---|
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| comodoca.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
| comodoca.com | domain | — | TCP | active | — |
| microsoft.com | domain | — | TCP | active | — |
C2 addresses are provided only from malware samples manually verified by the KEYDAL team. Commercial use is prohibited.