njrat | 1965b0ccf648da54d5571e016fb771040de218b85ffa9a88f8d6265588bb5fdf | Triage

Sharing

General

Target

1965b0ccf648da54d5571e016fb771040de218b85ffa9a88f8d6265588bb5fdf
Size

677KB
Sample

221003-byp63sccdp
MD5

6fe8d44d398005b74e89dfa194aa8a60
SHA1

7732ef3b5c162f4737006865f8fa8a92c49a8826
SHA256

1965b0ccf648da54d5571e016fb771040de218b85ffa9a88f8d6265588bb5fdf
SHA512

d985975ac0b45778c3258d7ef2f0ada6241af742a29ca8d5bd1ce4c0b139ba150f4df775c8064326108a7e087818cd7e2e84b1a23ef40650bfec4ff6d5e93f11
SSDEEP

12288:ph0tFZLexMG65AEMfuVQJ2TwMPBWhLP4tNrI9knsYzBWtAU3F/:3KZLexMGRJfuVQJ2T1PBKr4vRBsAUV

Score

10^/10

njrat gerador de cash evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

Gerador de Cash

C2

skillhacking1.ddns.net:1177

Mutex

08f4dc96bbb7af09d1a37fe35c75a42f

Attributes

reg_key
08f4dc96bbb7af09d1a37fe35c75a42f
splitter
|'|'|

Targets

- Target
  
  1965b0ccf648da54d5571e016fb771040de218b85ffa9a88f8d6265588bb5fdf
- Size
  
  677KB
- MD5
  
  6fe8d44d398005b74e89dfa194aa8a60
- SHA1
  
  7732ef3b5c162f4737006865f8fa8a92c49a8826
- SHA256
  
  1965b0ccf648da54d5571e016fb771040de218b85ffa9a88f8d6265588bb5fdf
- SHA512
  
  d985975ac0b45778c3258d7ef2f0ada6241af742a29ca8d5bd1ce4c0b139ba150f4df775c8064326108a7e087818cd7e2e84b1a23ef40650bfec4ff6d5e93f11
- SSDEEP
  
  12288:ph0tFZLexMG65AEMfuVQJ2TwMPBWhLP4tNrI9knsYzBWtAU3F/:3KZLexMGRJfuVQJ2T1PBKr4vRBsAUV
Score

10^/10

njrat gerador de cash evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njratgerador de cashevasionpersistencetrojan

behavioral2

njratgerador de cashevasionpersistencetrojan