njrat | 9085f329dbcbfae01a773a555db3dae06c197b2a7f6f733b82331a26ad4d46dd | Triage

Sharing

General

Target

download_2.exe
Size

32KB
Sample

240614-w2z6ns1hqg
MD5

0246e26daf22440fde0953edf3f90ad6
SHA1

9f3fe6fd7cd19f746ddd2beebc69dfd00a8e23ef
SHA256

9085f329dbcbfae01a773a555db3dae06c197b2a7f6f733b82331a26ad4d46dd
SHA512

d133e215bf2bfbf9b89f036581db8a98d3e08622be667787d9e19d3bf890bea4319d21fa7794c2c339d3c41ff323b9c4fb6fbd67c834df961e83017e987aeddf
SSDEEP

384:20bUe5XB4e0XmO/GiaXLilpknDZWTltTUFQqz9pOObbB:XT9Bu19aXWl1EtbB

Score

10^/10

njrat nyan cat execution

Malware Config

Extracted

Family

njrat

Version

0.7NC

Botnet

NYAN CAT

C2

carlitosmoreno1794.duckdns.org:2019

Mutex

bde06c84e1de4b23b

Attributes

reg_key
bde06c84e1de4b23b
splitter
@!#&^%$

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://pastebin.com/raw/V9y5Q5vv

Extracted

Language

ps1

Deobfuscated

URLs

ps1.dropper

http://pastebin.com/raw/V9y5Q5vv

Targets

- Target
  
  download_2.exe
- Size
  
  32KB
- MD5
  
  0246e26daf22440fde0953edf3f90ad6
- SHA1
  
  9f3fe6fd7cd19f746ddd2beebc69dfd00a8e23ef
- SHA256
  
  9085f329dbcbfae01a773a555db3dae06c197b2a7f6f733b82331a26ad4d46dd
- SHA512
  
  d133e215bf2bfbf9b89f036581db8a98d3e08622be667787d9e19d3bf890bea4319d21fa7794c2c339d3c41ff323b9c4fb6fbd67c834df961e83017e987aeddf
- SSDEEP
  
  384:20bUe5XB4e0XmO/GiaXLilpknDZWTltTUFQqz9pOObbB:XT9Bu19aXWl1EtbB
Score

10^/10

execution
- Blocklisted process makes network request
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Legitimate hosting services abused for malware hosting/C2
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1