njrat | a88a9fc866e2da0a88fbbf44e23b39b3bb980135b0d1c1aafbbef87490c2f34c | Triage

Sharing

General

Target

RFQ-474552121.vbs
Size

15KB
Sample

211026-qdstsshee4
MD5

147841ac2ca60229a754403fddad59ec
SHA1

9de7705976aec4bedd6f8805065ac17be1282d75
SHA256

a88a9fc866e2da0a88fbbf44e23b39b3bb980135b0d1c1aafbbef87490c2f34c
SHA512

92be569b47e9a8445bfb62b44b3bf3a1116b528520a958f037967f16a0746f9ff6c23ceab63c1d7159565e20656cdf193c768323efa0e151f407b9775516f4b4

Score

10^/10

njrat ------(xxx)------trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

------(XxX)------

C2

new.libya2020.com.ly:2020

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Targets

- Target
  
  RFQ-474552121.vbs
- Size
  
  15KB
- MD5
  
  147841ac2ca60229a754403fddad59ec
- SHA1
  
  9de7705976aec4bedd6f8805065ac17be1282d75
- SHA256
  
  a88a9fc866e2da0a88fbbf44e23b39b3bb980135b0d1c1aafbbef87490c2f34c
- SHA512
  
  92be569b47e9a8445bfb62b44b3bf3a1116b528520a958f037967f16a0746f9ff6c23ceab63c1d7159565e20656cdf193c768323efa0e151f407b9775516f4b4
Score

10^/10

njrat ------(xxx)------trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Blocklisted process makes network request
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrat------(xxx)------trojan

behavioral2

njrat------(xxx)------trojan