njrat | f92b8e334fa7d646f9f34336d340075c8b607727be46290d5b5d04346de3c257 | Triage

Sharing

General

Target

Server.exe
Size

790KB
Sample

250107-xv5y1svjgv
MD5

f8d0d5a67123a19bbda3691836a8aabc
SHA1

0170e410957f3208932abb3c42780b383f47f93f
SHA256

f92b8e334fa7d646f9f34336d340075c8b607727be46290d5b5d04346de3c257
SHA512

5b4aa252812e57390a23ea11117ad3a624969c6c0310c18e92cc099f752c2af184bd85bee29a8699366e0f6dae0825646e9392ee0cfe555fd0fcbb47f3fe12d9
SSDEEP

12288:mMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9nSN/j:mnsJ39LyjbJkQFMhmC+6GD9e

Score

10^/10

njrat xred backdoor discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

xred

C2

xred.mooo.com

Attributes

email
[email protected]
payload_url
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download

https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1

http://xred.site50.net/syn/SUpdate.ini

https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download

https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

http://xred.site50.net/syn/Synaptics.rar

https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download

https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1

http://xred.site50.net/syn/SSLLibrary.dll

Targets

- Target
  
  Server.exe
- Size
  
  790KB
- MD5
  
  f8d0d5a67123a19bbda3691836a8aabc
- SHA1
  
  0170e410957f3208932abb3c42780b383f47f93f
- SHA256
  
  f92b8e334fa7d646f9f34336d340075c8b607727be46290d5b5d04346de3c257
- SHA512
  
  5b4aa252812e57390a23ea11117ad3a624969c6c0310c18e92cc099f752c2af184bd85bee29a8699366e0f6dae0825646e9392ee0cfe555fd0fcbb47f3fe12d9
- SSDEEP
  
  12288:mMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9nSN/j:mnsJ39LyjbJkQFMhmC+6GD9e
Score

10^/10

njrat xred backdoor discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- Xred
  Xred is backdoor written in Delphi.
  backdoor xred
- Xred family
  xred
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratxredbackdoordiscoveryevasionpersistenceprivilege_escalationtrojan