njrat | 21bd72f49e3a9bd1778fa174fdd0cde88a11ad8bf3cba985fe1367c7154a7abb

General

Target
lol.exe
Size 4.1MB
Sample240523-rlsdnseb48
SHA256 21bd72f49e3a9bd1778fa174fdd0cde88a11ad8bf3cba985fe1367c7154a7abb
MD5 967d3eaa117f7ff867a91febcc8d2928
SHA1 638872b00b1a3eed215e60e78c93b8b5599a5898
SHA512 f45a2bf03a9b83f9a1201eeac1f03b8610969a361ff7e38e4b37f93e80d18a1f33452677caf8546775ac08e1b493fa86ecc859c3cf75d3af1199470b39d0ef35
SSDEEP 49152:toInYnAv1vYjUbQgvdkMgl2Zu7jfWL2ntzMqS1M+etxQnVIqwlwHnEOGc:toIcAv1vYjWSMy7PlnVw1+6q1ONB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Targets

- Target
  lol.exe
- Size 4.1MB
- SHA256 21bd72f49e3a9bd1778fa174fdd0cde88a11ad8bf3cba985fe1367c7154a7abb
- MD5 967d3eaa117f7ff867a91febcc8d2928
- SHA1 638872b00b1a3eed215e60e78c93b8b5599a5898
- SHA512 f45a2bf03a9b83f9a1201eeac1f03b8610969a361ff7e38e4b37f93e80d18a1f33452677caf8546775ac08e1b493fa86ecc859c3cf75d3af1199470b39d0ef35
- SSDEEP 49152:toInYnAv1vYjUbQgvdkMgl2Zu7jfWL2ntzMqS1M+etxQnVIqwlwHnEOGc:toIcAv1vYjWSMy7PlnVw1+6q1ONB
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

njrat umbral discovery evasion persistence spyware stealer trojan
- Detect Umbral payload
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- Windows security bypass
  evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Disables RegEdit via registry modification
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1