njrat | 92ac438e32bd604ac38a5a47ad5e5c1399f570b898f928c98e0ecfdc8efd848a

Resubmissions

23/06/2024, 02:08

240623-ckph3azank10

23/06/2024, 02:06

29/07/2023, 04:14

29/07/2023, 04:14

29/07/2023, 04:14

29/07/2023, 01:12

Sharing

Copy URL Twitter E-mail

General

Target
2f4de31e609dc9b0760ee32b2c0bfe90.bin
Size 17KB
Sample230729-et59aaah26
SHA256 92ac438e32bd604ac38a5a47ad5e5c1399f570b898f928c98e0ecfdc8efd848a
MD5 0c3f128c8f85767ffdf986faba38d3e9
SHA1 25c48236b7df6615a73269f28b4e2eb3b78fe0e7
SHA512 2bf3f7acfe1106d444a941c1e5cf1f97b446ecca8fbe3019d7e6596cdabe1e7fe5c72273f31a6b1369c9cdb1de5199b517d3793fc6d85f0358559e4eee9e3435
SSDEEP 384:3hZyUTkaCh/34ATltyTpM1PSSzLnYexBxMSh8aCf:RZrkaOP48AVcqa0SxB9M
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

2.tcp.eu.ngrok.io:19912

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Targets

- Target
  2f4de31e609dc9b0760ee32b2c0bfe90.bin
- Size 17KB
- SHA256 92ac438e32bd604ac38a5a47ad5e5c1399f570b898f928c98e0ecfdc8efd848a
- MD5 0c3f128c8f85767ffdf986faba38d3e9
- SHA1 25c48236b7df6615a73269f28b4e2eb3b78fe0e7
- SHA512 2bf3f7acfe1106d444a941c1e5cf1f97b446ecca8fbe3019d7e6596cdabe1e7fe5c72273f31a6b1369c9cdb1de5199b517d3793fc6d85f0358559e4eee9e3435
- SSDEEP 384:3hZyUTkaCh/34ATltyTpM1PSSzLnYexBxMSh8aCf:RZrkaOP48AVcqa0SxB9M
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral1 behavioral2
- Target
  96e9dcdbf13088adc418ca75982c7b329ea2774b71a74af6d8b55e70162dbd64.exe
- Size 43KB
- SHA256 96e9dcdbf13088adc418ca75982c7b329ea2774b71a74af6d8b55e70162dbd64
- MD5 2f4de31e609dc9b0760ee32b2c0bfe90
- SHA1 f8325c7f97d279277882666425ea482e5385cb99
- SHA512 815c45e3a355ae91d8f6f701ed5417f331f55363a42cfcb54b675f368ef5d57725bba57174109c64d38f099d54dad2bd4c76f332be7b38043f197024e8826df1
- SSDEEP 384:oZyZ1Cj8syWhFXA0ENeEUsMEZEAftz8Iij+ZsNO3PlpJKkkjh/TzF7pWnp/greTr:eO04pWnXAJzMETXuXQ/ow3+L
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

njrat hacked trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral3 behavioral4

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

njRAT/Bladabindi

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4