njrat | 4eb0b835d61c2be5e193c6a6aadb7952e6754ce8b65bb5d589c316537eef0ad8 | Triage

Sharing

General

Target

8a168f78a99617be9f29c3804bb3747f.exe
Size

166KB
Sample

240928-xr23ysvaqa
MD5

8a168f78a99617be9f29c3804bb3747f
SHA1

ab481df52d157f5eb9862839eaee170397980e2b
SHA256

4eb0b835d61c2be5e193c6a6aadb7952e6754ce8b65bb5d589c316537eef0ad8
SHA512

1edce923a173c84a4c3f231216f633badb712f98157c20218880c3d472631ef8b9750fc91bda578830d1f32544527cf0c8f1c997f1f7d26b75f8288069552365
SSDEEP

3072:gmXQN/L1mhktBszkTk0p4rgm/wUywhAVPPlEfpxKNPAe1SocbDbn5vZfzWb:gmXlQT7OrF/wUywh42fAPAMcbfdZf

Score

10^/10

njrat discovery trojan

Malware Config

Targets

- Target
  
  8a168f78a99617be9f29c3804bb3747f.exe
- Size
  
  166KB
- MD5
  
  8a168f78a99617be9f29c3804bb3747f
- SHA1
  
  ab481df52d157f5eb9862839eaee170397980e2b
- SHA256
  
  4eb0b835d61c2be5e193c6a6aadb7952e6754ce8b65bb5d589c316537eef0ad8
- SHA512
  
  1edce923a173c84a4c3f231216f633badb712f98157c20218880c3d472631ef8b9750fc91bda578830d1f32544527cf0c8f1c997f1f7d26b75f8288069552365
- SSDEEP
  
  3072:gmXQN/L1mhktBszkTk0p4rgm/wUywhAVPPlEfpxKNPAe1SocbDbn5vZfzWb:gmXlQT7OrF/wUywh42fAPAMcbfdZf
Score

10^/10

njrat discovery trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoverytrojan

behavioral2