njrat | hxxps://raw[.]githubusercontent[.]com/cybertoxin/Remcos-Professional-Cracked-By-Alcatraz3222/master/Remcos%20Professional%20Cracked%20By%20Alcatraz3222[.]zip

Resubmissions

28-08-2022 16:20

220828-ttcpasbgbl 10

28-08-2022 16:08

220828-tk67jsbehj 10

Sharing

Copy URL

Twitter E-mail

General

Target

https://raw.githubusercontent.com/cybertoxin/Remcos-Professional-Cracked-By-Alcatraz3222/master/Remcos%20Professional%20Cracked%20By%20Alcatraz3222.zip
Sample

220828-tk67jsbehj

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

dllsys.duckdns.org:3202

Mutex

3b570ffeeb3d34249b9a5ce0ee58a328

Attributes

reg_key
3b570ffeeb3d34249b9a5ce0ee58a328
splitter
svchost

Targets

- Target
  
  https://raw.githubusercontent.com/cybertoxin/Remcos-Professional-Cracked-By-Alcatraz3222/master/Remcos%20Professional%20Cracked%20By%20Alcatraz3222.zip
Score

10^/10

njrat hacked evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

T1102

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

njRAT/Bladabindi

Executes dropped EXE

Modifies Windows Firewall

Checks computer location settings

Legitimate hosting services abused for malware hosting/C2

Suspicious use of NtSetInformationThreadHideFromDebugger

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

urlscan1

behavioral1

behavioral2