njrat | fddd2c104500971da3ec56f930dcd53da181c0c45e47f5a25a57028afb642e29 | Triage

Sharing

General

Target

fddd2c104500971da3ec56f930dcd53da181c0c45e47f5a25a57028afb642e29.exe
Size

543KB
Sample

241015-cwtbdstdnq
MD5

aa9e75e91b3ac6ad8868e9906beccf54
SHA1

29d755c2aae31a9f1f743538ca268c51687ce8e8
SHA256

fddd2c104500971da3ec56f930dcd53da181c0c45e47f5a25a57028afb642e29
SHA512

5b64b516484cee819c8602a233f7be77904a725ed9a7a91dcd54b5aa1bc0d9a8ff4489798b87388c7a2c2216c5ef70bdcd337b9384fb66abe38bea2b0f346163
SSDEEP

12288:GVRmalyw9qfcaF52WgAIsAxOfqV42Rqol0M0pMsRNQSJGmENwMp3:ARigAm3lTaK

Score

10^/10

njrat victim discovery trojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

Victim

C2

167.71.14.135:963

Mutex

svchost.exe

Attributes

reg_key
svchost.exe
splitter
|Ghost|

Targets

- Target
  
  fddd2c104500971da3ec56f930dcd53da181c0c45e47f5a25a57028afb642e29.exe
- Size
  
  543KB
- MD5
  
  aa9e75e91b3ac6ad8868e9906beccf54
- SHA1
  
  29d755c2aae31a9f1f743538ca268c51687ce8e8
- SHA256
  
  fddd2c104500971da3ec56f930dcd53da181c0c45e47f5a25a57028afb642e29
- SHA512
  
  5b64b516484cee819c8602a233f7be77904a725ed9a7a91dcd54b5aa1bc0d9a8ff4489798b87388c7a2c2216c5ef70bdcd337b9384fb66abe38bea2b0f346163
- SSDEEP
  
  12288:GVRmalyw9qfcaF52WgAIsAxOfqV42Rqol0M0pMsRNQSJGmENwMp3:ARigAm3lTaK
Score

10^/10

njrat victim discovery trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratvictimdiscoverytrojan

behavioral2

njratvictimdiscoverytrojan