njrat | 962a9410609dda2ee32b704ba31d4cb4f70f14249cd8a183f5ebfaea63973c1d | Triage

Sharing

General

Target

New Client.exe
Size

65KB
Sample

241005-zpzk6asdnq
MD5

73d3a7f8e88738107d9af5dce1d0aa01
SHA1

4fc3adf92eb563101d218e67e65e66321a9609ad
SHA256

962a9410609dda2ee32b704ba31d4cb4f70f14249cd8a183f5ebfaea63973c1d
SHA512

12ed60a8cbd417e42297c14b5527c7eeb60b828a3124463b96e4d228c9b3ea96da11b836bde9478fcb65aadd1ba9cd743b038825aa24460ccd82fbc869a63612
SSDEEP

1536:Aaawk8oN36tlQviFw10AglBnvA3fLteF3nLrB9z3n3aF9bJS9vM:Aaawk8oN36tlQviFCnUBnofWl9znaF9J

Score

10^/10

njrat debilu discovery

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

Debilu

C2

127.0.0.1:7999

Mutex

COM Surrogate

Attributes

reg_key
COM Surrogate
splitter
|Ghost|

Targets

- Target
  
  New Client.exe
- Size
  
  65KB
- MD5
  
  73d3a7f8e88738107d9af5dce1d0aa01
- SHA1
  
  4fc3adf92eb563101d218e67e65e66321a9609ad
- SHA256
  
  962a9410609dda2ee32b704ba31d4cb4f70f14249cd8a183f5ebfaea63973c1d
- SHA512
  
  12ed60a8cbd417e42297c14b5527c7eeb60b828a3124463b96e4d228c9b3ea96da11b836bde9478fcb65aadd1ba9cd743b038825aa24460ccd82fbc869a63612
- SSDEEP
  
  1536:Aaawk8oN36tlQviFw10AglBnvA3fLteF3nLrB9z3n3aF9bJS9vM:Aaawk8oN36tlQviFCnUBnofWl9znaF9J
Score

7^/10

discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1