njrat | a024d7bd35a2ecef3773792aa82d46522e6ee0d170e8b5a84acae765ddc058b2 | Triage™

Login
Reports

Overview

overview

Static

static

Server.exe

windows11-21h2-x64

Resubmissions

22/05/2024, 18:16

240522-wweyjsbe8v10

22/05/2024, 18:15

240522-wwchesbe7y10

22/05/2024, 18:11

240522-wslxpabd6s10

22/05/2024, 18:10

240522-wsfqnsbe4410

22/05/2024, 18:10

240522-wsdajsbe3910

22/05/2024, 18:10

240522-wr9mcsbd5w10

22/05/2024, 18:10

240522-wr668sbe3210

22/05/2024, 18:10

240522-wr35ksbe2710

22/05/2024, 18:08

240522-wq26wsbd6410

22/05/2024, 18:08

240522-wqx7yabd5710

Sharing

Copy URL Twitter E-mail

General

Target
Server.exe
Size 43KB
Sample240522-wweyjsbe8v
SHA256 a024d7bd35a2ecef3773792aa82d46522e6ee0d170e8b5a84acae765ddc058b2
MD5 49ad4c0475749e6dd6001f5a038ab6a8
SHA1 4e31ba96d944bb61c65e459153f5762ebde54338
SHA512 4304e871c505b2a0bf6a12292ac50e7c6665c6b73138f6501f3c091a5bc2d41c6237c6a019a03530d451bb7b35241c89ac71478c283af2ee57e488fb55bca087
SSDEEP 384:tbZyjJ61STss7yKS9po7QAMExZZS23zsIij+ZsNO3PlpJKkkjh/TzF7pWnXmgreT:/0Qk4smKS3OR9Z0OuXQ/o6C+L
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat wannacry hacked defense_evasion discovery execution impact persistence ransomware spyware stealer trojan worm

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

Server.exe

Resource

win11-20240508-en

windows11-21h2-x64

24 signatures

150 seconds

njrat wannacry hacked defense_evasion discovery execution impact persistence ransomware spyware stealer trojan worm

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

19.ip.gl.ply.gg:60143

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\@[email protected]

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Targets

- Target
  Server.exe
- Size 43KB
- SHA256 a024d7bd35a2ecef3773792aa82d46522e6ee0d170e8b5a84acae765ddc058b2
- MD5 49ad4c0475749e6dd6001f5a038ab6a8
- SHA1 4e31ba96d944bb61c65e459153f5762ebde54338
- SHA512 4304e871c505b2a0bf6a12292ac50e7c6665c6b73138f6501f3c091a5bc2d41c6237c6a019a03530d451bb7b35241c89ac71478c283af2ee57e488fb55bca087
- SSDEEP 384:tbZyjJ61STss7yKS9po7QAMExZZS23zsIij+ZsNO3PlpJKkkjh/TzF7pWnXmgreT:/0Qk4smKS3OR9Z0OuXQ/o6C+L
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

njrat wannacry hacked defense_evasion discovery execution impact persistence ransomware spyware stealer trojan worm
- Wannacry
  WannaCry is a ransomware cryptoworm.
  ransomware worm wannacry
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Deletes shadow copies
  Ransomware often targets backup files to inhibit system recovery.
  ransomware defense_evasion impact execution
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Adds Run key to start application
  persistence
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

File and Directory Permissions Modification

Hide Artifacts

Hidden Files and Directories

Indicator Removal

File Deletion

Modify Registry

Credential Access

Unsecured Credentials

Credentials In Files

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

Command and Control

Exfiltration

Impact

Defacement

Inhibit System Recovery

Tasks

static1

behavioral1

njratwannacryhackeddefense_evasiondiscoveryexecutionimpactpersistenceransomwarespywarestealertrojanworm

© 2018-2026

Terms | Privacy