njrat | 2d04a0d8fac45912b00ddc206423b2a0536e2a035642729535852f6d163946ee

General

Target

tmpuB1xoC.vbs
Size

757KB
Sample

220806-g9zsjseae5
MD5

9dc5849357ad8c24dee16b6103c76e07
SHA1

71934dc525d7cff4d493a5737d34188dd1906ec4
SHA256

2d04a0d8fac45912b00ddc206423b2a0536e2a035642729535852f6d163946ee
SHA512

127bc5c32c8811771d2acbeebe1675b64cadae777158e55f10ec724a92396a70ce67c451443470e1eb630834f916a76c8f4c080f2a431119d6fc40e204c297d3

Score

10^/10

njrat trojan

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

https://cdn.discordapp.com/attachments/979582020927774773/980218074567421972/dl.txt

Extracted

Family

njrat

C2

puerto2547.duckdns.org:2547

Mutex

d52c2b17132548b

Attributes

reg_key
d52c2b17132548b
splitter
@!#&^%$

Targets

- Target
  
  tmpuB1xoC.vbs
- Size
  
  757KB
- MD5
  
  9dc5849357ad8c24dee16b6103c76e07
- SHA1
  
  71934dc525d7cff4d493a5737d34188dd1906ec4
- SHA256
  
  2d04a0d8fac45912b00ddc206423b2a0536e2a035642729535852f6d163946ee
- SHA512
  
  127bc5c32c8811771d2acbeebe1675b64cadae777158e55f10ec724a92396a70ce67c451443470e1eb630834f916a76c8f4c080f2a431119d6fc40e204c297d3
Score

10^/10

njrat trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

njRAT/Bladabindi

Blocklisted process makes network request

Checks computer location settings

Drops startup file

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2