Overview

overview

10

Static

static

9fb660eca8...bb.vbs

windows7_x64

10

9fb660eca8...bb.vbs

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9fb660eca8d9ed1038a8cffc032e59bb.vbs

  • Size

    151KB

  • Sample

    211217-yyy6baebd4

  • MD5

    9fb660eca8d9ed1038a8cffc032e59bb

  • SHA1

    4aff5b55b1b499cec665f46b132856a4a300b4e9

  • SHA256

    2a196da9c5e2dcf30d7eb90464a4296bc1f0046958836157c07ab4782e5af108

  • SHA512

    0bcb0de54a3bdbe9d0e2be1899ab05060a7db58ae6e53aeed82a54b99f126502e0366415e590f22909aa9531c272af8287c6d5f06ece31de21156bcc2ef81790

Score
10/10
asyncratnjratnyan catrattrojan

Malware Config

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://91.241.19.49/ramdes/DownloaderF3.txt

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://91.241.19.49/ramdes/DownloaderF3.txt

Extracted

Language
ps1
Deobfuscated
URLs
ps1.dropper

http://91.241.19.49/ramdes/DownloaderF3.txt

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

revg.duckdns.org:57831

Mutex

ebef4abe57d24e8

Attributes
  • reg_key

    ebef4abe57d24e8

  • splitter

    @!#&^%$

Targets

    • Target

      9fb660eca8d9ed1038a8cffc032e59bb.vbs

    • Size

      151KB

    • MD5

      9fb660eca8d9ed1038a8cffc032e59bb

    • SHA1

      4aff5b55b1b499cec665f46b132856a4a300b4e9

    • SHA256

      2a196da9c5e2dcf30d7eb90464a4296bc1f0046958836157c07ab4782e5af108

    • SHA512

      0bcb0de54a3bdbe9d0e2be1899ab05060a7db58ae6e53aeed82a54b99f126502e0366415e590f22909aa9531c272af8287c6d5f06ece31de21156bcc2ef81790

    Score
    10/10
    asyncratnjratnyan catrattrojan

    • AsyncRat

      AsyncRAT is designed to remotely monitor and control other computers.

      ratasyncrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Async RAT payload

      rat

    • Blocklisted process makes network request

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks