njrat | 2d5964d5c8e6b8cfc4e143160f8d1d29475218f9b86324864411d3c991bee8d5

General

Target

payload.js
Size

254B
Sample

211210-zhmysabbfl
MD5

d6c1fa2786171c21d3f12b40db9973db
SHA1

f61d2307582855a0c214a21f7bfe78a8cfdcbc24
SHA256

2d5964d5c8e6b8cfc4e143160f8d1d29475218f9b86324864411d3c991bee8d5
SHA512

7cf20a00d0b63e7c3e9164bebca0d834376db1d8fd383647c14b6e5eefa229b5d6528ef41290c8656e78bc69f641b7060e9023f0401459562677922715325386

Score

10^/10

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://cdn.discordapp.com/attachments/910897865386250264/915258994195582976/link..txt

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

dominio12.duckdns.org:4433

Mutex

9015ff612ab2

Attributes

reg_key
9015ff612ab2
splitter
@!#&^%$

Targets

- Target
  
  payload.js
- Size
  
  254B
- MD5
  
  d6c1fa2786171c21d3f12b40db9973db
- SHA1
  
  f61d2307582855a0c214a21f7bfe78a8cfdcbc24
- SHA256
  
  2d5964d5c8e6b8cfc4e143160f8d1d29475218f9b86324864411d3c991bee8d5
- SHA512
  
  7cf20a00d0b63e7c3e9164bebca0d834376db1d8fd383647c14b6e5eefa229b5d6528ef41290c8656e78bc69f641b7060e9023f0401459562677922715325386
Score

10^/10

njrat nyan cat suricata trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

njRAT/Bladabindi

suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

Blocklisted process makes network request

Drops startup file

Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2