njrat | 09630f5f1a47d6fe6b02d74de4c077876b6c607c183e241e82e72d10fb4c0ea0 | Triage

Resubmissions

03-02-2025 19:11

250203-xv42qazngt 10

03-02-2025 19:07

250203-xswbss1rdm 10

03-02-2025 19:04

250203-xrbwrs1qhn 10

02-02-2025 15:00

250202-sdj8rswpez 10

Sharing

General

Target

XWorm-5.6-main.zip
Size

17.4MB
Sample

250203-xv42qazngt
MD5

f8766a4d7853f38b9a5cb8b9e7e601a0
SHA1

23eb644f84f35180aaf334f00659e8b907b45833
SHA256

09630f5f1a47d6fe6b02d74de4c077876b6c607c183e241e82e72d10fb4c0ea0
SHA512

65dbea03faa6f50d454292cbccd51ca099ab82bb56136643df69ea4790a842464a99cce79a26b8d1813be221bd4486c7c16d7b14597f269e0f2030f2d2f2574a
SSDEEP

393216:wA1udbqUg2idC/kZz9g+430arKdAcXrO5VyAEBQ2T0ORhk:wCXUg2IhZS65rO5V8BQS04hk

Score

10^/10

njrat stormkitty xworm by aflaton defense_evasion discovery execution trojan

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

By AFlatoN

C2

147.185.221.22:40639

Mutex

b2e31adf64af873c0fa30a8ea1b8e5b8

Attributes

reg_key
b2e31adf64af873c0fa30a8ea1b8e5b8
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  XWorm-5.6-main.zip
- Size
  
  17.4MB
- MD5
  
  f8766a4d7853f38b9a5cb8b9e7e601a0
- SHA1
  
  23eb644f84f35180aaf334f00659e8b907b45833
- SHA256
  
  09630f5f1a47d6fe6b02d74de4c077876b6c607c183e241e82e72d10fb4c0ea0
- SHA512
  
  65dbea03faa6f50d454292cbccd51ca099ab82bb56136643df69ea4790a842464a99cce79a26b8d1813be221bd4486c7c16d7b14597f269e0f2030f2d2f2574a
- SSDEEP
  
  393216:wA1udbqUg2idC/kZz9g+430arKdAcXrO5VyAEBQ2T0ORhk:wCXUg2IhZS65rO5V8BQS04hk
Score

10^/10

njrat by aflaton defense_evasion discovery execution trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Stops running service(s)
  defense_evasion execution
- Executes dropped EXE
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

PowerShell

Scheduled Task/Job

Scheduled Task

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Create or Modify System Process

Windows Service

Scheduled Task/Job

Scheduled Task

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

by aflatonstormkittyxwormnjrat

behavioral1

behavioral2

njratby aflatondefense_evasiondiscoveryexecutiontrojan