Overview
overview
10Static
static
10NjRat 0.7D...23.exe
windows10-2004-x64
10Plugin/cam.dll
windows10-2004-x64
1Plugin/ch.dll
windows10-2004-x64
1Plugin/mic.dll
windows10-2004-x64
1Plugin/plg.dll
windows10-2004-x64
1Plugin/pw.dll
windows10-2004-x64
1Plugin/sc2.dll
windows10-2004-x64
1Server.exe
windows10-2004-x64
8Stub.ps1
windows10-2004-x64
1WinMM.Net.dll
windows10-2004-x64
1nj_users/V...og.rtf
windows10-2004-x64
1nj_users/X...og.rtf
windows10-2004-x64
1General
-
Target
NjRat.0.7D.Green.Edition.zip
-
Size
2.2MB
-
Sample
240302-as231sfg57
-
MD5
5e9879dfb0eb64e734c28f514f208418
-
SHA1
0b5e8d1f6c777a07b6da9de781e7525d6c0b7562
-
SHA256
72029d0005d9b3130cdbdba3d6d6129a817f073b5eaedd79345729042e586a25
-
SHA512
df9017285c26e528765e89f70d148f5654dad3797839aff610e017d2afe30b55f3df54a46633ce9dc8de8b984ab3b38db6bcabbb8adf3fb561fa36c9fd383bea
-
SSDEEP
49152:z91Heasnn4LOb5a7kQdWH7xKQtkWhCTNMH9xf1aawYLngK0posG+:z91Hn80y/7KQyW4TGHfnyosG+
Behavioral task
behavioral1
Sample
NjRat 0.7D Green Edition by im523.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
Plugin/cam.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Plugin/ch.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral4
Sample
Plugin/mic.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
Plugin/plg.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral6
Sample
Plugin/pw.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Plugin/sc2.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral8
Sample
Server.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
Stub.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral10
Sample
WinMM.Net.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
nj_users/VM-РџРљ_vm_602F4037/Keylog.rtf
Resource
win10v2004-20240226-en
Behavioral task
behavioral12
Sample
nj_users/XTREME-HPHU46T6_Администратор_EE0C994/Keylog.rtf
Resource
win10v2004-20240226-en
Malware Config
Extracted
njrat
im523
hacked
185.204.1.236:1111
c15cd7ce3aae2bd6036dd10a665f69f9
-
reg_key
c15cd7ce3aae2bd6036dd10a665f69f9
-
splitter
|'|'|
Extracted
njrat
im523
HacKed
127.0.0.1:5552
165d6ed988ac1dbec1627a1ca9899d84
-
reg_key
165d6ed988ac1dbec1627a1ca9899d84
-
splitter
|'|'|
Targets
-
-
Target
NjRat 0.7D Green Edition by im523.exe
-
Size
1.6MB
-
MD5
1033c448810d3b507423546432e2f502
-
SHA1
2bf9d04f68ed15b957378fb95daa78c85d5b2b26
-
SHA256
f0c85722b88d1e7a1941ba17551cd5c29aef99fad86d78a5631a0f5446b3f580
-
SHA512
aeb964632dfad41fc383a68ace0e6beb152a7075f21a32e449624a27da5d2a5ccda0665fbd90597d65d74b0790877baf6f81336660b1df4bf38b41cd0bc6cd44
-
SSDEEP
12288:ouicuiPszLSDeMFFFFFFFNPjiRfbljmYpNk1Yt6JwpwqVcTeec7neIjjpL:ouicui0zLSDRPjiRfzUcpcNgD
-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
-
-
Target
Plugin/cam.dll
-
Size
63KB
-
MD5
a73edb60b80a2dfa86735d821bea7b19
-
SHA1
f39a54d7bc25425578a2b800033e4508714a73ed
-
SHA256
7a4977b024d048b71bcc8f1cc65fb06e4353821323f852dc6740b79b9ab75c98
-
SHA512
283e9206d0b56c1f8b0741375ccd0a184410cf89f5f42dfe91e7438c5fd0ac7fa4afbb84b8b7ea448b3093397552fd3731b9be74c67b846d946da486dcf0df68
-
SSDEEP
1536:7EoML5LFXbUu5ExN3hep+cx4sKcuxpSe:7ERZxQxep+cx5Kcu3
Score1/10 -
-
-
Target
Plugin/ch.dll
-
Size
24KB
-
MD5
73c8a5cd64fcf87186a6a9ac870df509
-
SHA1
7ea0bd1f15d7c8bc8b259b3a409b2cd3b0fe3eec
-
SHA256
7722206dba0cfb290f33093f9430cb770a160947001715ae11e6dbbfaef1c0ee
-
SHA512
b5faaf370d951bccd34da369e970d75c8f038bbfc99cf042c89a4ceb9cc077c1c8fc81318d79180c67373cca8024d27aaba052d4cee82a3aeda8d59ad0ac817d
-
SSDEEP
384:nok/7+I98wxOatKr3xcNRPKtoMlqfpibcWY2EvHqNiaR6D3sO9:c6oh4RiHlqhi/EvDou
Score1/10 -
-
-
Target
Plugin/mic.dll
-
Size
50KB
-
MD5
d4c5ddc00f27162fc0947830e0e762b7
-
SHA1
7769be616d752e95d80e167f2ef4cc6b8c3c21fe
-
SHA256
b6fb6b66821e70a27a4750b0cd0393e4ee2603a47feac48d6a3d66d1c1cb56d5
-
SHA512
9555f800213f2f4a857b4558aa4d030edf41485b8366812d5a6b9adcc77fc21584e30d2dd9ce515846f3a809c85038958cb8174bf362cf6fed97ca99a826e379
-
SSDEEP
1536:YmXfC5RemUFTxqPbSiQZrCF1HzGL17d8:YmXfCgFTxq+iQZrGTGL17d8
Score1/10 -
-
-
Target
Plugin/plg.dll
-
Size
28KB
-
MD5
0cbc2d9703feead9783439e551c2b673
-
SHA1
4f8f4addd6f9e60598a7f4a191a89a52201394a8
-
SHA256
ea9ecf8723788feef6492bf938cdfab1266a1558dffe75e1f78a998320f96e39
-
SHA512
06f55b542000e23f5eeba45ea5ff9ffaddddd102935e039e4496af5e5083f257129dab2f346eeae4ee864f54db57d3c73cf6ed1d3568087411203769cf0ddd66
-
SSDEEP
384:iLa+IgaVdBJfFfZsDNujglHdUky5P6bL2XIadYweVqJE+La7gmlweR9Oq7Bp2RhG:8ZIgYdbfAhdGJ6bL6YT2fO9vca2kSs
Score1/10 -
-
-
Target
Plugin/pw.dll
-
Size
251KB
-
MD5
872401528fc94c90f3de6658e776cc36
-
SHA1
c58e22158774d16831350de79eb4e1711379e8a6
-
SHA256
3a1cc072effd8c38406a6fddf4d8f49c5366bb0e32071311d90db669940987ce
-
SHA512
6da881fb968ba9d9200777a9f19d69220468482f3eaaf687c433790d512da520f5adb23441fdc8f3fd10785918eb2864ea3ef32ddb80d2f6665550ea455f4a2f
-
SSDEEP
6144:/e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMO1:WxJ/JmSG9T8CEgdM
Score1/10 -
-
-
Target
Plugin/sc2.dll
-
Size
12KB
-
MD5
19967e886edcd2f22f8d4a58c8ea3773
-
SHA1
bf6e0e908eaad659fdd32572e9d73c5476ca26ec
-
SHA256
3e5141c75b7746c0eb2b332082a165deacb943cef26bd84668e6b79b47bdfd93
-
SHA512
d471df3f0d69909e8ef9f947da62c77c3ff1eb97ac1dd53a74ad09fb4d74ec26c3c22facc18ec04f26df3b85b0c70863119f5baa090b110ab25383fcdb4e9d6e
-
SSDEEP
192:3SDU/WQw9hM/BIlbzMmY3CX80B2/mZLks4LX08Lt6dD5DHqKlZTFzfpni48nafL8:3SDOOMJIpIm8/IQs4z08IdD5DvZTFTpM
Score1/10 -
-
-
Target
Server.exe
-
Size
37KB
-
MD5
92c80777998fb2d7cf4a89e3c0485c32
-
SHA1
1af70450af73c0a589ed7c0eb07e6c5cf800f319
-
SHA256
3b6074646068cfd2536df69f95c2b7d45ea1ca196098bede73a9dbdcba8e96e5
-
SHA512
711d2485afb622c2769b7485b920651676699386458ab301eae23207973463afe8f2fc53df045d9ebb764d1ce16b45c68384e1dbd2679a1a30837bb4dc32b92c
-
SSDEEP
384:9FGBkiyRnDNGRn5IyUvoIdf1hg/SuswcrAF+rMRTyN/0L+EcoinblneHQM3epzXx:DZ5M5jUvtdAaufcrM+rMRa8NuzZt
Score8/10-
Modifies Windows Firewall
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Executes dropped EXE
-
Adds Run key to start application
-
-
-
Target
Stub.il
-
Size
399KB
-
MD5
3575abf7ab346ec4039138fad1fab4b7
-
SHA1
c5c7b08cfcb707cab339d966e36de6c3c97bd7f5
-
SHA256
ed79411707d5a9925f1146e595983804e4eeafe35e72eb51703908eff13cc073
-
SHA512
2044d78e20a4d7b8acbc0ebf61c38176314ccf02a0b009b161530b78658444faed8304a628938514d98effe5ebdd81275e1328f65d98ec3f2e545f9c9de56179
-
SSDEEP
12288:YbidABkcrO7qU+1gtxPXEx8V0IC0FcUYpm+0DGG+ld+HkZCpC654tDarkic:s
Score1/10 -
-
-
Target
WinMM.Net.dll
-
Size
43KB
-
MD5
d4b80052c7b4093e10ce1f40ce74f707
-
SHA1
2494a38f1c0d3a0aa9b31cf0650337cacc655697
-
SHA256
59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
-
SHA512
3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
-
SSDEEP
768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
Score1/10 -
-
-
Target
nj_users/VM-РџРљ_vm_602F4037/Keylog.rtf
-
Size
182B
-
MD5
92122da996c66cbd51d8c6ea868739c5
-
SHA1
685b9da98ac120cf133d55faa4e4a8438d1439cb
-
SHA256
9a27937010fa2be4c9f3634fee0bf20cbdeb64bc7141ab1beda02c06de27f869
-
SHA512
152fbf1314cfe26d3119868f8c83f6c332b9f4ea2a63034f91a4e66182575c90a2e6303c5ef2442e8a4deacb30f29277ae35870dba01505770fa0fa87ccc3838
Score1/10 -
-
-
Target
nj_users/XTREME-HPHU46T6_Администратор_EE0C994/Keylog.rtf
-
Size
397B
-
MD5
890cbd4acf6ba3b475f59bf3d583da83
-
SHA1
655e0c60316c93973457ba5145de9e6a15a83567
-
SHA256
c1534af7f44d83c419a261e90f1b226fd26171a3a55a494bc831006f9474ad5b
-
SHA512
2d69b16799c11a785ea891dee1574d605bc57fb2ebc98dfd0a9d631a24dba597f4b5aa042a16a0d681358f804d00ebe4b3575af426649b8ce803bb9512a1c05f
Score1/10 -
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1