njrat | 8d49faffc4942c34bffdd584d638e39f528bde1b7c65827aa352dba1e80d5b8c

General

Target

Adobe Photoshop 2022 v23.0.0.36 (x64) Pre-Cracked\Setup\Setup.exe
Size

1.6MB
Sample

211213-zp7a1afddq
MD5

efd9742b88dcd244637fd20e58bf7427
SHA1

85b521125ed49818c05c3a0b5ccb51d1770e91f8
SHA256

8d49faffc4942c34bffdd584d638e39f528bde1b7c65827aa352dba1e80d5b8c
SHA512

0f722e9438bf1fcf8dd04179d49f0f439e39158366cdac0605c87ce751cd1d16fe5bf81fb3afed627d55701a00be01c17ae017295fc95b24502bd4e7c72ff8be

Score

10^/10

Malware Config

Targets

- Target
  
  Adobe Photoshop 2022 v23.0.0.36 (x64) Pre-Cracked\Setup\Setup.exe
- Size
  
  1.6MB
- MD5
  
  efd9742b88dcd244637fd20e58bf7427
- SHA1
  
  85b521125ed49818c05c3a0b5ccb51d1770e91f8
- SHA256
  
  8d49faffc4942c34bffdd584d638e39f528bde1b7c65827aa352dba1e80d5b8c
- SHA512
  
  0f722e9438bf1fcf8dd04179d49f0f439e39158366cdac0605c87ce751cd1d16fe5bf81fb3afed627d55701a00be01c17ae017295fc95b24502bd4e7c72ff8be
Score

10^/10

discovery njrat quasar spyware suricata trojan upx
- Quasar Payload
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata
- suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
  suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)
  suricata
- Blocklisted process makes network request
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Remote System Discovery

1

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Targets

Quasar Payload

Quasar RAT

njRAT/Bladabindi

suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)

suricata: ET MALWARE Observed Malicious SSL Cert (Quasar CnC)

Blocklisted process makes network request

Executes dropped EXE

UPX packed file

Drops startup file

Loads dropped DLL

Checks installed software on the system

Looks up external IP address via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2