njrat | a024d7bd35a2ecef3773792aa82d46522e6ee0d170e8b5a84acae765ddc058b2

max time kernel
149s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 18:07

Sharing

Target

Server.exe
Size

43KB
MD5

49ad4c0475749e6dd6001f5a038ab6a8
SHA1

4e31ba96d944bb61c65e459153f5762ebde54338
SHA256

a024d7bd35a2ecef3773792aa82d46522e6ee0d170e8b5a84acae765ddc058b2
SHA512

4304e871c505b2a0bf6a12292ac50e7c6665c6b73138f6501f3c091a5bc2d41c6237c6a019a03530d451bb7b35241c89ac71478c283af2ee57e488fb55bca087
SSDEEP

384:tbZyjJ61STss7yKS9po7QAMExZZS23zsIij+ZsNO3PlpJKkkjh/TzF7pWnXmgreT:/0Qk4smKS3OR9Z0OuXQ/o6C+L

Score

10^/10

njrat hacked trojan

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

19.ip.gl.ply.gg:60143

Mutex

Windows Update

Attributes

njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat
Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

Server.exe

pid process

616 Server.exe

pid	process
616	Server.exe

Suspicious use of AdjustPrivilegeToken 37 IoCs

Processes:

Server.exe

description	pid	process
Token: SeDebugPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe
Token: 33	616	Server.exe
Token: SeIncBasePriorityPrivilege	616	Server.exe

memory/616-0-0x0000000073F4E000-0x0000000073F4F000-memory.dmp

Filesize
4KB

Download
memory/616-1-0x0000000000B20000-0x0000000000B32000-memory.dmp

Filesize
72KB

Download
memory/616-2-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download
memory/616-3-0x0000000073F4E000-0x0000000073F4F000-memory.dmp

Filesize
4KB

Download
memory/616-4-0x0000000073F40000-0x000000007462E000-memory.dmp

Filesize
6.9MB

Download