njrat | 3278da5825f2fa9fe2fae3a9cb16d3d8e3c47828c2258153e02567c7bc423fec | Triage

Sharing

General

Target

360feb26856fd5accc8e656c23edaf38.exe
Size

43KB
Sample

230323-fk4jrsdf32
MD5

360feb26856fd5accc8e656c23edaf38
SHA1

1dcc19bc5f4c2bc259b40c2ba2a92e8fb35ac288
SHA256

3278da5825f2fa9fe2fae3a9cb16d3d8e3c47828c2258153e02567c7bc423fec
SHA512

75449ad3efdbad7046d2bd29c89aed435498498957e5b14f21ca928100a023acab0514c5c206c86ba9830f60e96d0222310879d23e974d057cbdfdab54b0ba9d
SSDEEP

384:68ZyiQt3VarE8yTH/fq5WKOEnsDay0+TzEIij+ZsNO3PlpJKkkjh/TzF7pWnB/gm:66t63MY5Tffq5hGDFuXQ/oQ3+L

Score

10^/10

njrat hacked trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

5.tcp.eu.ngrok.io:19987

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Targets

- Target
  
  360feb26856fd5accc8e656c23edaf38.exe
- Size
  
  43KB
- MD5
  
  360feb26856fd5accc8e656c23edaf38
- SHA1
  
  1dcc19bc5f4c2bc259b40c2ba2a92e8fb35ac288
- SHA256
  
  3278da5825f2fa9fe2fae3a9cb16d3d8e3c47828c2258153e02567c7bc423fec
- SHA512
  
  75449ad3efdbad7046d2bd29c89aed435498498957e5b14f21ca928100a023acab0514c5c206c86ba9830f60e96d0222310879d23e974d057cbdfdab54b0ba9d
- SSDEEP
  
  384:68ZyiQt3VarE8yTH/fq5WKOEnsDay0+TzEIij+ZsNO3PlpJKkkjh/TzF7pWnB/gm:66t63MY5Tffq5hGDFuXQ/oQ3+L
Score

10^/10

njrat hacked trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

njrathackedtrojan

behavioral2

njrathackedtrojan