njrat | 46910a6dfb9487947703a1f69d55e76b0d6bdc560a5ed85e7fd65c48924ea6b6 | Triage

Sharing

General

Target

kkkkkk.vbs
Size

484KB
Sample

220111-tpggpagdgq
MD5

c411c39688a4e3be08e80fcef384b448
SHA1

2970efe8b3902cd3edb2d41258b1888e494eef37
SHA256

46910a6dfb9487947703a1f69d55e76b0d6bdc560a5ed85e7fd65c48924ea6b6
SHA512

8bc088ce4b622e3a0cf7111eaae437cfa2211c6bfca248f6e42a166a6eede54c65fee73cf64652e8c3dd5d2f3764c556677e1bfd195873d491f5d7e7cf3ae0ee

Score

10^/10

njrat nyan cat suricata trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://149.56.200.165/dll/3.txt

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

david123456.duckdns.org:9000

remcosos.duckdns.org:1988

Mutex

b14f9f9db82b4

Attributes

reg_key
b14f9f9db82b4
splitter
@!#&^%$

Targets

- Target
  
  kkkkkk.vbs
- Size
  
  484KB
- MD5
  
  c411c39688a4e3be08e80fcef384b448
- SHA1
  
  2970efe8b3902cd3edb2d41258b1888e494eef37
- SHA256
  
  46910a6dfb9487947703a1f69d55e76b0d6bdc560a5ed85e7fd65c48924ea6b6
- SHA512
  
  8bc088ce4b622e3a0cf7111eaae437cfa2211c6bfca248f6e42a166a6eede54c65fee73cf64652e8c3dd5d2f3764c556677e1bfd195873d491f5d7e7cf3ae0ee
Score

10^/10

njrat nyan cat suricata trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata
- Blocklisted process makes network request
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Remote System Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njratnyan catsuricatatrojan