njrat | bf1b584ffc094a70fb7d4a7528a69cf305afe4578cf473eb54abb4fa5d29737a

General

Target

Server.exe
Size

37KB
Sample

220612-lv1hracca9
MD5

de5071b8b40fc5f663515a3e0c1c6898
SHA1

86dab3f7c9fcf0ed55a7240e31a4d36e0a7c72f5
SHA256

bf1b584ffc094a70fb7d4a7528a69cf305afe4578cf473eb54abb4fa5d29737a
SHA512

2b6e284017a2a8100b2038c9d3109ba947084015161d53e2f055ec105ddf2b626c5c97f6e0f22c1138b5bc65d25fc56255042a0be9ad937d5a04fdb5e90d1f5d

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

7.tcp.eu.ngrok.io:11560

Mutex

3a7624b2898c278949c78ad5de1ea5bf

Attributes

reg_key
3a7624b2898c278949c78ad5de1ea5bf
splitter
|'|'|

Extracted

Family

njrat

Version

im523

Botnet

popka

C2

185.204.1.236:8648

Mutex

73669228637201240c020112fc761ef3

Attributes

reg_key
73669228637201240c020112fc761ef3
splitter
|'|'|

Targets

- Target
  
  Server.exe
- Size
  
  37KB
- MD5
  
  de5071b8b40fc5f663515a3e0c1c6898
- SHA1
  
  86dab3f7c9fcf0ed55a7240e31a4d36e0a7c72f5
- SHA256
  
  bf1b584ffc094a70fb7d4a7528a69cf305afe4578cf473eb54abb4fa5d29737a
- SHA512
  
  2b6e284017a2a8100b2038c9d3109ba947084015161d53e2f055ec105ddf2b626c5c97f6e0f22c1138b5bc65d25fc56255042a0be9ad937d5a04fdb5e90d1f5d
Score

10^/10

njrat ramnit hacked popka banker evasion persistence spyware stealer suricata trojan upx worm
- Ramnit
  Ramnit is a versatile family that holds viruses, worms, and Trojans.
  trojan spyware stealer worm banker ramnit
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback (Remote Desktop)
  suricata
- suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
  suricata: ET MALWARE njrat ver 0.7d Malware CnC Callback Response (Remote Desktop)
  suricata
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1