njrat | 8d0ccea5465761b45f1f952575e8cd533c2c4d34b37f26daa40ac0cfec960a5a

General

Target

8d0ccea5465761b45f1f952575e8cd533c2c4d34b37f26daa40ac0cfec960a5a
Size

9.0MB
Sample

220207-y9crfsghek
MD5

142b6b8c0ae513112a1579783d2ad5cb
SHA1

7f05045c4fe37c64efb8af7c23cdcafee37b38b5
SHA256

8d0ccea5465761b45f1f952575e8cd533c2c4d34b37f26daa40ac0cfec960a5a
SHA512

c9b081aece3db9aae4053818e1d2c385661cc9c8f8effc2ef8786b5ba50ac1b2dd9ba6fb2d0722b7d3963eeda32c41dffd1fdd4dfa1b52fbbda0fdcb4af6ca39

Score

10^/10

Malware Config

Extracted

Family

vjw0rm

C2

http://todoaqui.duckdns.org:7979

Extracted

Family

njrat

Version

0.7d

Botnet

aaanoi

C2

njhost.hopto.org:5553

Mutex

5c66e3e0723ecdf0c3e307768c9cf0dd

Attributes

reg_key
5c66e3e0723ecdf0c3e307768c9cf0dd
splitter
|'|'|

Targets

- Target
  
  8d0ccea5465761b45f1f952575e8cd533c2c4d34b37f26daa40ac0cfec960a5a
- Size
  
  9.0MB
- MD5
  
  142b6b8c0ae513112a1579783d2ad5cb
- SHA1
  
  7f05045c4fe37c64efb8af7c23cdcafee37b38b5
- SHA256
  
  8d0ccea5465761b45f1f952575e8cd533c2c4d34b37f26daa40ac0cfec960a5a
- SHA512
  
  c9b081aece3db9aae4053818e1d2c385661cc9c8f8effc2ef8786b5ba50ac1b2dd9ba6fb2d0722b7d3963eeda32c41dffd1fdd4dfa1b52fbbda0fdcb4af6ca39
Score

10^/10

vjw0rm xmrig miner persistence suricata trojan upx worm njrat aaanoi
- Suspicious use of NtCreateProcessExOtherParentProcess
- Vjw0rm
  Vjw0rm is a remote access trojan written in JavaScript.
  trojan worm vjw0rm
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
  suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1
  suricata
- suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA
  suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA
  suricata
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- XMRig Miner Payload
  miner
- Blocklisted process makes network request
- Executes dropped EXE
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Cryptocurrency Miner
  Makes network request to known mining pool URL.
  miner
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Query Registry

3

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Suspicious use of NtCreateProcessExOtherParentProcess

Vjw0rm

njRAT/Bladabindi

suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin 1

suricata: ET MALWARE Worm.VBS Dunihi/Houdini/H-Worm Checkin UA

xmrig

XMRig Miner Payload

Blocklisted process makes network request

Executes dropped EXE

UPX packed file

Checks computer location settings

Cryptocurrency Miner

Drops startup file

Loads dropped DLL

Adds Run key to start application

MITRE ATT&CK Enterprise v6

Tasks

static1

behavioral1

behavioral2