njrat | 3c333cca8a3575459888665c629c5af42fc1849e8011306441a0ae773d996fb2

General

Target

3c333cca8a3575459888665c629c5af42fc1849e8011306441a0ae773d996fb2
Size

613KB
Sample

220703-j6ts8sbgan
MD5

3d354d274bea923b12e3950de7f51eea
SHA1

3ca4aec7982bfbf10804685172974148dbca9d8b
SHA256

3c333cca8a3575459888665c629c5af42fc1849e8011306441a0ae773d996fb2
SHA512

083826b7348648de76f9112f347057ab2b99a466eb3b444d8a23074dc54882f9ef279513d33443afad51e9ccd51bc6d7cdcba2e9ec9ddb8beb68c6b5310e2cb9

Score

10^/10

njrat pony exploited++collection discovery persistence rat spyware stealer suricata trojan

Malware Config

Extracted

Family

pony

C2

http://al-hadin.com/pony/gate.php

http://al-hadin.com/cj/gate.php

Attributes

payload_url
http://michmetals.info/bin/Myshit.exe

Extracted

Family

njrat

Version

0.7.3

Botnet

Exploited++

C2

salesxpert.duckdns.org:2889

Mutex

windows.exe

Attributes

reg_key
windows.exe
splitter
mnbvcxz12

Targets

- Target
  
  3c333cca8a3575459888665c629c5af42fc1849e8011306441a0ae773d996fb2
- Size
  
  613KB
- MD5
  
  3d354d274bea923b12e3950de7f51eea
- SHA1
  
  3ca4aec7982bfbf10804685172974148dbca9d8b
- SHA256
  
  3c333cca8a3575459888665c629c5af42fc1849e8011306441a0ae773d996fb2
- SHA512
  
  083826b7348648de76f9112f347057ab2b99a466eb3b444d8a23074dc54882f9ef279513d33443afad51e9ccd51bc6d7cdcba2e9ec9ddb8beb68c6b5310e2cb9
Score

10^/10

njrat pony exploited++collection discovery persistence rat spyware stealer suricata trojan
- Pony,Fareit
  Pony is a Remote Access Trojan application that steals information.
  rat spyware stealer pony
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata: ET MALWARE Generic njRAT/Bladabindi CnC Activity (ll)
  suricata
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Reads data files stored by FTP clients
  Tries to access configuration files associated with programs like FileZilla.
  spyware stealer
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses Microsoft Outlook accounts
  collection
- Accesses Microsoft Outlook profiles
  collection
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2