njrat | bdb1e7dad9b0a128ac7509c61e9e50174b630bb09d990b111e6d7a2578035062 | Triage

Sharing

General

Target

bdb1e7dad9b0a128ac7509c61e9e50174b630bb09d990b111e6d7a2578035062
Size

1.0MB
Sample

221126-gcfneaab3z
MD5

b2a785daf0d6e73c753dd24ae7a360b5
SHA1

8dcc8b411ede0407e939fb47278340d2fe1d1a2e
SHA256

bdb1e7dad9b0a128ac7509c61e9e50174b630bb09d990b111e6d7a2578035062
SHA512

ea7198043d3056277c7ead0097fb28fbcd6fb6a651b2d51eae248e53483f2e867428ed6ccd358db6793b2312d9c6257116428995f13a1032578da0bc23e9ca3a
SSDEEP

12288:zhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aDPrpJlyYPg8ulSxc:5RmJkcoQricOIQxiZY1iaRJlytSe

Score

10^/10

njrat youtube trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Youtube

C2

kchalloub.ddns.net:1153

Mutex

8cd96541bf771b90376de77eb46eeccd

Attributes

reg_key
8cd96541bf771b90376de77eb46eeccd
splitter
|'|'|

Targets

- Target
  
  bdb1e7dad9b0a128ac7509c61e9e50174b630bb09d990b111e6d7a2578035062
- Size
  
  1.0MB
- MD5
  
  b2a785daf0d6e73c753dd24ae7a360b5
- SHA1
  
  8dcc8b411ede0407e939fb47278340d2fe1d1a2e
- SHA256
  
  bdb1e7dad9b0a128ac7509c61e9e50174b630bb09d990b111e6d7a2578035062
- SHA512
  
  ea7198043d3056277c7ead0097fb28fbcd6fb6a651b2d51eae248e53483f2e867428ed6ccd358db6793b2312d9c6257116428995f13a1032578da0bc23e9ca3a
- SSDEEP
  
  12288:zhkDgouVA2nxKkorvdRgQriDwOIxmxiZnYQE7PJcE4aDPrpJlyYPg8ulSxc:5RmJkcoQricOIQxiZY1iaRJlytSe
Score

10^/10

njrat youtube trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

njratyoutubetrojan