njrat | 1d84ff128228995c275b3e6c05cd19e4e46fcb7574cbd7fb3934abb3df3d1129

General

Target

lol.exe
Size

9.2MB
Sample

240523-rzn86see6x
MD5

93296816398ac7ff5fc9d91f8d2765b2
SHA1

f5817b3d34c22d0f847028797db143d75f592536
SHA256

1d84ff128228995c275b3e6c05cd19e4e46fcb7574cbd7fb3934abb3df3d1129
SHA512

fef4af08ce771ffad5eb500813052b93ff3c4c71711c03e9c9314fd16212b89fa14f77ca9f648c57617600c4fb932ebb7dd5bf97685e480106f79c98ac15885c
SSDEEP

196608:tbVYKe7PFQhn5EQ9hNQAYzA5k6cTWDn7JKObS09BBI3:pzu25EWheYkv8LlB23

Score

10^/10

Malware Config

Targets

- Target
  
  lol.exe
- Size
  
  9.2MB
- MD5
  
  93296816398ac7ff5fc9d91f8d2765b2
- SHA1
  
  f5817b3d34c22d0f847028797db143d75f592536
- SHA256
  
  1d84ff128228995c275b3e6c05cd19e4e46fcb7574cbd7fb3934abb3df3d1129
- SHA512
  
  fef4af08ce771ffad5eb500813052b93ff3c4c71711c03e9c9314fd16212b89fa14f77ca9f648c57617600c4fb932ebb7dd5bf97685e480106f79c98ac15885c
- SSDEEP
  
  196608:tbVYKe7PFQhn5EQ9hNQAYzA5k6cTWDn7JKObS09BBI3:pzu25EWheYkv8LlB23
Score

10^/10

njrat umbral bootkit discovery evasion persistence spyware stealer trojan
- Detect Umbral payload
- Modifies WinLogon for persistence
  persistence
- Modifies visibility of file extensions in Explorer
  evasion
- Modifies visiblity of hidden/system files in Explorer
  evasion
- UAC bypass
  evasion trojan
- Umbral
  Umbral stealer is an opensource moduler stealer written in C#.
  stealer umbral
- Windows security bypass
  evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Disables RegEdit via registry modification
  evasion
- Drops file in Drivers directory
- Manipulates Digital Signatures
  Attackers can apply techniques such as modifying certain DLL exports to make their binary seem valid.
- .NET Reactor proctector
  Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE
- Modifies file permissions
  discovery
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Checks whether UAC is enabled
  evasion trojan
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
- Modifies WinLogon
  persistence
- Writes to the Master Boot Record (MBR)
  Bootkits write to the MBR to gain persistence at a level below the operating system.
  bootkit persistence
- AutoIT Executable
  AutoIT scripts compiled to PE executables.
- Drops file in System32 directory
behavioral1