njrat | 8bda4be105d4767cbf7b264931f375535945f10cf9b4096258b1d151a56897e3

General

Target

8bda4be105d4767cbf7b264931f375535945f10cf9b4096258b1d151a56897e3
Size

461KB
Sample

220521-agdlaaabh4
MD5

a3f35aba528d19877d8cc5b2e06fa9a0
SHA1

0334cc7794bddf94a577ddc399bad9ed3f492a2b
SHA256

8bda4be105d4767cbf7b264931f375535945f10cf9b4096258b1d151a56897e3
SHA512

2b3e42b73886d655110c101256b65cd58118329cf393dd9eae38b66e1259b44dbd2b3cd3964d7e8aa3031360180bc92b2df8c0914c50605842c710b6e2f4533b

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

njRAT 0.8D New.Private

C2

37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150,37.252.7.150:5555

Mutex

ba98a577fe66f770ed9ea26aff587406

Attributes

reg_key
ba98a577fe66f770ed9ea26aff587406
splitter
|'|'|

Targets

- Target
  
  8bda4be105d4767cbf7b264931f375535945f10cf9b4096258b1d151a56897e3
- Size
  
  461KB
- MD5
  
  a3f35aba528d19877d8cc5b2e06fa9a0
- SHA1
  
  0334cc7794bddf94a577ddc399bad9ed3f492a2b
- SHA256
  
  8bda4be105d4767cbf7b264931f375535945f10cf9b4096258b1d151a56897e3
- SHA512
  
  2b3e42b73886d655110c101256b65cd58118329cf393dd9eae38b66e1259b44dbd2b3cd3964d7e8aa3031360180bc92b2df8c0914c50605842c710b6e2f4533b
Score

10^/10

njrat njrat 0.8d new.private evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2