njrat | ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb

General

Target

target.ps1
Size

1B
Sample

230510-xg1gdahg97
MD5

0cc175b9c0f1b6a831c399e269772661
SHA1

86f7e437faa5a7fce15d1ddcb9eaeaea377667b8
SHA256

ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb
SHA512

1f40fc92da241694750979ee6cf582f2d5d7d28e18335de05abc54d0560e0f5302860c652bf08d560252aa5e74210546f369fbbbce8c12cfc7957b2652fe9a75

Score

10^/10

Malware Config

Targets

- Target
  
  target.ps1
- Size
  
  1B
- MD5
  
  0cc175b9c0f1b6a831c399e269772661
- SHA1
  
  86f7e437faa5a7fce15d1ddcb9eaeaea377667b8
- SHA256
  
  ca978112ca1bbdcafac231b39a23dc4da786eff8147c4e72b9807785afee48bb
- SHA512
  
  1f40fc92da241694750979ee6cf582f2d5d7d28e18335de05abc54d0560e0f5302860c652bf08d560252aa5e74210546f369fbbbce8c12cfc7957b2652fe9a75
Score

10^/10

njrat adware discovery evasion persistence spyware stealer trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Contacts a large (59993) amount of remote hosts
  This may indicate a network scan to discover remotely running services.
  discovery
- Creates a large amount of network flows
  This may indicate a network scan to discover remotely running services.
  discovery
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Registers COM server for autorun
  persistence
- Adds Run key to start application
  persistence
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Checks whether UAC is enabled
  evasion trojan
- Installs/modifies Browser Helper Object
  BHOs are DLL modules which act as plugins for Internet Explorer.
  stealer adware
behavioral1