njrat | hxxp://t[.]me/excellent_stalcraft

Resubmissions

26/08/2023, 19:03

230826-xqhypacf65 8

26/08/2023, 18:13

26/08/2023, 18:03

26/08/2023, 18:03

26/08/2023, 18:00

26/08/2023, 11:10

26/08/2023, 11:04

Sharing

Copy URL

Twitter E-mail

General

Target

http://t.me/excellent_stalcraft
Sample

230826-wlsfwscd78

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

mamasita

hakim32.ddns.net:2000

ago-shopper.gl.at.ply.gg:33932

Mutex

e9b5d9adb3bd2d12b3b209e6217534e3

Attributes

reg_key
e9b5d9adb3bd2d12b3b209e6217534e3
splitter
|'|'|

Targets

- Target
  
  http://t.me/excellent_stalcraft
Score

10^/10

njrat mamasita evasion trojan upx
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- UPX packed file
  Detects executables packed with UPX/modified UPX open source packer.
  upx
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Resubmissions

Sharing

General

Malware Config

Extracted

Targets

njRAT/Bladabindi

Modifies Windows Firewall

UPX packed file

MITRE ATT&CK Enterprise v15

Tasks

static1

urlscan1

behavioral1