njrat | 33c8efdf697a2bf43e2aace180bd3512e51e422aa562c6a3ecb0b04d893ea656

Sharing

Copy URL Twitter E-mail

General

Target
DCrat.rar
Size 1.4MB
Sample250105-pmvjbatpgs
SHA256 33c8efdf697a2bf43e2aace180bd3512e51e422aa562c6a3ecb0b04d893ea656
MD5 dadb31f9cd6b19e2aa650eabcf03fdce
SHA1 f8b860ac70adb921a96408ed564b7426b9eabd96
SHA512 e2f2599a5ba122b5c54ddaf65756a92b360217e9cdbcc3cbea0f3319a78e6a3be4be8292dcec5716882a6b46947fd517f15d7f4a25574a8e927ba1ba6c825246
SSDEEP 24576:UngkscuNKWHWDvcweijLMLY7VtCXlj3LvHxoK9T79EL9aDR4W1Bk0XZxR:UngXecWjciA+t0vvf97WLEDRJBvJxR
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

5.tcp.eu.ngrok.io:19587

Mutex

d8c514f6c639c3b8951aabb752c3344a

Attributes

reg_key
d8c514f6c639c3b8951aabb752c3344a
splitter
|'|'|

Targets

- Target
  DCrat-Crack/DCrat-main Crack.exe
- Size 37KB
- SHA256 31c37ff61aa322192236c9672f09e3d97b6e6e09c5019077df7d0567d4c0b48b
- MD5 744e1221f6467d0b7e73a10f52e6cd6c
- SHA1 33e85ae9412fa870e5d6de31502e7d48c64ce224
- SHA512 704389db8c842344a21c4563f1154b57bf208466083b1fded330c4f53b7931fdb216e1e8dada0733729f8ac7aebf1047e77d7c96d2b6950b7bc69872b93a90de
- SSDEEP 384:6yTMUiDHblmJEpRGyEfBffXuKCYyEAnrAF+rMRTyN/0L+EcoinblneHQM3epzXGd:fTqHpR9EfBfWKClEOrM+rMRa8NuoXt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1
- Target
  DCrat-Crack/Plugin/cam.dll
- Size 63KB
- SHA256 7a4977b024d048b71bcc8f1cc65fb06e4353821323f852dc6740b79b9ab75c98
- MD5 a73edb60b80a2dfa86735d821bea7b19
- SHA1 f39a54d7bc25425578a2b800033e4508714a73ed
- SHA512 283e9206d0b56c1f8b0741375ccd0a184410cf89f5f42dfe91e7438c5fd0ac7fa4afbb84b8b7ea448b3093397552fd3731b9be74c67b846d946da486dcf0df68
- SSDEEP 1536:7EoML5LFXbUu5ExN3hep+cx4sKcuxpSe:7ERZxQxep+cx5Kcu3
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral2
- Target
  DCrat-Crack/Plugin/ch.dll
- Size 24KB
- SHA256 7722206dba0cfb290f33093f9430cb770a160947001715ae11e6dbbfaef1c0ee
- MD5 73c8a5cd64fcf87186a6a9ac870df509
- SHA1 7ea0bd1f15d7c8bc8b259b3a409b2cd3b0fe3eec
- SHA512 b5faaf370d951bccd34da369e970d75c8f038bbfc99cf042c89a4ceb9cc077c1c8fc81318d79180c67373cca8024d27aaba052d4cee82a3aeda8d59ad0ac817d
- SSDEEP 384:nok/7+I98wxOatKr3xcNRPKtoMlqfpibcWY2EvHqNiaR6D3sO9:c6oh4RiHlqhi/EvDou
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral3
- Target
  DCrat-Crack/Plugin/mic.dll
- Size 50KB
- SHA256 b6fb6b66821e70a27a4750b0cd0393e4ee2603a47feac48d6a3d66d1c1cb56d5
- MD5 d4c5ddc00f27162fc0947830e0e762b7
- SHA1 7769be616d752e95d80e167f2ef4cc6b8c3c21fe
- SHA512 9555f800213f2f4a857b4558aa4d030edf41485b8366812d5a6b9adcc77fc21584e30d2dd9ce515846f3a809c85038958cb8174bf362cf6fed97ca99a826e379
- SSDEEP 1536:YmXfC5RemUFTxqPbSiQZrCF1HzGL17d8:YmXfCgFTxq+iQZrGTGL17d8
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral4
- Target
  DCrat-Crack/Plugin/plg.dll
- Size 28KB
- SHA256 ea9ecf8723788feef6492bf938cdfab1266a1558dffe75e1f78a998320f96e39
- MD5 0cbc2d9703feead9783439e551c2b673
- SHA1 4f8f4addd6f9e60598a7f4a191a89a52201394a8
- SHA512 06f55b542000e23f5eeba45ea5ff9ffaddddd102935e039e4496af5e5083f257129dab2f346eeae4ee864f54db57d3c73cf6ed1d3568087411203769cf0ddd66
- SSDEEP 384:iLa+IgaVdBJfFfZsDNujglHdUky5P6bL2XIadYweVqJE+La7gmlweR9Oq7Bp2RhG:8ZIgYdbfAhdGJ6bL6YT2fO9vca2kSs
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral5
- Target
  DCrat-Crack/Plugin/pw.dll
- Size 251KB
- SHA256 3a1cc072effd8c38406a6fddf4d8f49c5366bb0e32071311d90db669940987ce
- MD5 872401528fc94c90f3de6658e776cc36
- SHA1 c58e22158774d16831350de79eb4e1711379e8a6
- SHA512 6da881fb968ba9d9200777a9f19d69220468482f3eaaf687c433790d512da520f5adb23441fdc8f3fd10785918eb2864ea3ef32ddb80d2f6665550ea455f4a2f
- SSDEEP 6144:/e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMO1:WxJ/JmSG9T8CEgdM
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

discovery
behavioral6
- Target
  DCrat-Crack/Plugin/sc2.dll
- Size 12KB
- SHA256 3e5141c75b7746c0eb2b332082a165deacb943cef26bd84668e6b79b47bdfd93
- MD5 19967e886edcd2f22f8d4a58c8ea3773
- SHA1 bf6e0e908eaad659fdd32572e9d73c5476ca26ec
- SHA512 d471df3f0d69909e8ef9f947da62c77c3ff1eb97ac1dd53a74ad09fb4d74ec26c3c22facc18ec04f26df3b85b0c70863119f5baa090b110ab25383fcdb4e9d6e
- SSDEEP 192:3SDU/WQw9hM/BIlbzMmY3CX80B2/mZLks4LX08Lt6dD5DHqKlZTFzfpni48nafL8:3SDOOMJIpIm8/IQs4z08IdD5DvZTFTpM
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral7
- Target
  DCrat-Crack/Stub.il
- Size 399KB
- SHA256 ed79411707d5a9925f1146e595983804e4eeafe35e72eb51703908eff13cc073
- MD5 3575abf7ab346ec4039138fad1fab4b7
- SHA1 c5c7b08cfcb707cab339d966e36de6c3c97bd7f5
- SHA512 2044d78e20a4d7b8acbc0ebf61c38176314ccf02a0b009b161530b78658444faed8304a628938514d98effe5ebdd81275e1328f65d98ec3f2e545f9c9de56179
- SSDEEP 12288:YbidABkcrO7qU+1gtxPXEx8V0IC0FcUYpm+0DGG+ld+HkZCpC654tDarkic:s
- MD5 SHA1 SHA512 SSDEEP
Score

3^/10

execution
behavioral8
- Target
  DCrat-Crack/WinMM.Net.dll
- Size 43KB
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- MD5 SHA1 SHA512 SSDEEP
Score

1^/10
behavioral9