njrat | c32577dff97968f5315c154fcfc3ea5341d23298cff5a8616c930ea91eb7637c

General

Target

1313.exe
Size

55KB
Sample

241004-1bppga1hpc
MD5

708d040a8df490185aa7a8bfd814092e
SHA1

a96d64734c89a20c81b50547e202aa00801f20ec
SHA256

c32577dff97968f5315c154fcfc3ea5341d23298cff5a8616c930ea91eb7637c
SHA512

3f54edec358b8ed8dbb60bcbfbc29f773c73aaff0a5935f44992143621afcf368f1bded568e7e1b3274829e2eb577fac2d5ca4f13e32bd5e0ee01e7deb06787a
SSDEEP

1536:WGLu8DnN8N1+S1Cl/BODuwsNMDxXExI3pm2m:Y8DnNGcXODuwsNMDxXExI3pm

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Pack

C2

txx8luo.localto.net:4683

Mutex

bd434710efce297ce77ab32aae3c09bb

Attributes

reg_key
bd434710efce297ce77ab32aae3c09bb
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  1313.exe
- Size
  
  55KB
- MD5
  
  708d040a8df490185aa7a8bfd814092e
- SHA1
  
  a96d64734c89a20c81b50547e202aa00801f20ec
- SHA256
  
  c32577dff97968f5315c154fcfc3ea5341d23298cff5a8616c930ea91eb7637c
- SHA512
  
  3f54edec358b8ed8dbb60bcbfbc29f773c73aaff0a5935f44992143621afcf368f1bded568e7e1b3274829e2eb577fac2d5ca4f13e32bd5e0ee01e7deb06787a
- SSDEEP
  
  1536:WGLu8DnN8N1+S1Cl/BODuwsNMDxXExI3pm2m:Y8DnNGcXODuwsNMDxXExI3pm
Score

10^/10

njrat discovery trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

njRAT/Bladabindi

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2