njrat | 84f5ec233777bbb8beff694828b95279e0167d48b2cfdd9f1f9385c6fdfdcc3d

General

Target

NewStub.exe
Size

36KB
Sample

211003-14pvyafgen
MD5

ae0911261255e0743dcecc6c3245abdf
SHA1

c9c6abfc195be44d02e8a79361821ff8d5e1b1c1
SHA256

84f5ec233777bbb8beff694828b95279e0167d48b2cfdd9f1f9385c6fdfdcc3d
SHA512

730ed33b1a196f05746aeb44edce872c2b9a2d2ebfd0e3fa86864eadf6d08899497d01b6c225ba1344a579b1dfb5087fe5f7ca0f13f089bb3aaed7c1bb95f004

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

Mutex

e99e462d99ad204bdf7d672852a4e30a

Attributes

reg_key
e99e462d99ad204bdf7d672852a4e30a
splitter
|'|'|

Targets

- Target
  
  NewStub.exe
- Size
  
  36KB
- MD5
  
  ae0911261255e0743dcecc6c3245abdf
- SHA1
  
  c9c6abfc195be44d02e8a79361821ff8d5e1b1c1
- SHA256
  
  84f5ec233777bbb8beff694828b95279e0167d48b2cfdd9f1f9385c6fdfdcc3d
- SHA512
  
  730ed33b1a196f05746aeb44edce872c2b9a2d2ebfd0e3fa86864eadf6d08899497d01b6c225ba1344a579b1dfb5087fe5f7ca0f13f089bb3aaed7c1bb95f004
Score

10^/10

njrat hacked evasion persistence suricata trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Microphone)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Microphone)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Get Passwords)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Get Passwords)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
  suricata
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2