1e055a9f8a9736a965b5615e26eaff24d5e53e6286db804bf043e4432aa61a21

Sharing

Copy URL Twitter E-mail

General

Target
njRAT v0.12G.zip
Size 2.1MB
Sample260604-vtj9tabz3p
SHA256 1e055a9f8a9736a965b5615e26eaff24d5e53e6286db804bf043e4432aa61a21
MD5 bf9862ecdf72e04d1900d46f4e8a5733
SHA1 a72b21bfa2093e472527349df7434b43b1fc9cf5
SHA512 ca1ef4dc813b1392a7daf7411e48650a17ab38b23bbdc430c97cc3d57b8971641f4702af8d7db0a410e4e7dff9dedb439af8c071a35d6ef261f58b802f85a62f
SSDEEP 49152:N5NPzlQHPw97Coo9d5oYSmFV4o5xzCQcqw+:bNPgw97Cooj5rrVVZCBqw+
TLSH
T13EA5336AA9E38073DCD6D1BFB638341C691A56700E50F43697FFD728AE688B0071B761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  njRAT v0.12G.zip
- Size 2.1MB
- SHA256 1e055a9f8a9736a965b5615e26eaff24d5e53e6286db804bf043e4432aa61a21
- MD5 bf9862ecdf72e04d1900d46f4e8a5733
- SHA1 a72b21bfa2093e472527349df7434b43b1fc9cf5
- SHA512 ca1ef4dc813b1392a7daf7411e48650a17ab38b23bbdc430c97cc3d57b8971641f4702af8d7db0a410e4e7dff9dedb439af8c071a35d6ef261f58b802f85a62f
- SSDEEP 49152:N5NPzlQHPw97Coo9d5oYSmFV4o5xzCQcqw+:bNPgw97Cooj5rrVVZCBqw+
- TLSH
  T13EA5336AA9E38073DCD6D1BFB638341C691A56700E50F43697FFD728AE688B0071B761
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  njRAT v0.12G/Alert.wav
- Size 23KB
- SHA256 a76aa44b4924a960d020cc82c0e29e840f46fd81ec05c91ddbf4f42169ade4db
- MD5 ff8b7adc4209146b4ec595a986fd6384
- SHA1 1630cfd169baad76ba47fc725f296bd4fbd26bbd
- SHA512 f6e6ef9dd841d8265f6d6f0f26965c467c8db6d60b81eaf6bc8aa85c2b77ad5e9cb939a30ef37349f7ed666480847e0dd0d26e61fb0a5b12bac1d58045d6f510
- SSDEEP 384:2fNSnOOUe9RcnAEtrNEAl0Zcp1+XKnRPXnIbMUjwu8SKZelRGSQMQRWFV:W4nB1OnXLPlmcL+XKRPvUEu8elRosFV
- TLSH
  T132B26B9384E1B0425E0FC6B9FE1BC9A8F14AD8DDCDCDD75A5114E63690F6232C29F982
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral2
- Target
  njRAT v0.12G/GeoIP.dat
- Size 1.2MB
- SHA256 8a0675001b5bc63d8389fc7ed80b4a7b0f9538c744350f00162533519e106426
- MD5 797b96cc417d0cde72e5c25d0898e95e
- SHA1 8c63d0cc8a3a09c1fe50c856b8e5170a63d62f13
- SHA512 9bb0c40c83551000577f8cf0b8a7c344bc105328a2c564df70fabec978ad267fa42e248c11fb78166855b0816d2ef3ec2c12fe52f8cc0b83e366e46301340882
- SSDEEP 24576:X49Ncvb7y4+FFfI12ky0dBRQ3fNLxDKefhoFbQfAACiTQVapg:o9Nhw1vJ83fNLxu2UVa2
- TLSH
  T106555A16FF8599DB08523D2EF81A8D9C08699D35FC0A0336316E7B5D90747A8EDE60E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral3
- Target
  njRAT v0.12G/Mono.Cecil.dll
- Size 305KB
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH
  T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  njRAT v0.12G/Plugin/cam.dll
- Size 63KB
- SHA256 7a4977b024d048b71bcc8f1cc65fb06e4353821323f852dc6740b79b9ab75c98
- MD5 a73edb60b80a2dfa86735d821bea7b19
- SHA1 f39a54d7bc25425578a2b800033e4508714a73ed
- SHA512 283e9206d0b56c1f8b0741375ccd0a184410cf89f5f42dfe91e7438c5fd0ac7fa4afbb84b8b7ea448b3093397552fd3731b9be74c67b846d946da486dcf0df68
- SSDEEP 1536:7EoML5LFXbUu5ExN3hep+cx4sKcuxpSe:7ERZxQxep+cx5Kcu3
- TLSH
  T15153286E6B98A11AC18D52BC50B74F4007F1D64AA323EB4A6B7851FCDD733808B5379B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  njRAT v0.12G/Plugin/ch.dll
- Size 12KB
- SHA256 6e31148cc1b3235b71731c3944a7b06f861e104e978708d12c695ec09b5b3760
- MD5 e747fa3339c1f138b6bfce707b541d03
- SHA1 b95c54fbd6eb20ba4b4e69736b574baa2699ab8e
- SHA512 b970c3e8bf6a2e3ae920bc8bd014edb86ca92c85a2bccff732c7e5eb2f81ffbd902a34a0a68bd51545954b5f4d6dd1bb84b5c005868c0659717eba2892a67355
- SSDEEP 192:pc/uGfMx2+zkUakpBZHrPzYuPYrDq+PzDuGRDAVEBP6jUvsB3npn3mNFcTf:wuGk2oakpBZHrPzYuPYrW+bDPRDiEBPE
- TLSH
  T15642D62577A88B63C96DA77D45A2534133F3D1118222DFAB7DCA68EC4DE63C51B0039B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  njRAT v0.12G/Plugin/fun.dll
- Size 21KB
- SHA256 92a2bb77ac664dce38ef839dad9c9a3d9aece152ed432894654650ea6345fde8
- MD5 c724c870d0d5b291a93a41252e1d46df
- SHA1 57fe1efb9f3dae1138d8a6314a76e7f4c5368242
- SHA512 3505cbc7b6310057e5f21466d5b4a3f0a07a5b5ba05048c6ba87a8ba87a1d213105a33b89bef1febe685a01d37432089ca43e5b377f034a8f07cea3eff7d5f1e
- SSDEEP 384:xiHLTIdCtjOxUX5U5Ig0bDLZqCbbYLRUmEIAx4bTrU:AwdF5Ig0rXI/zU
- TLSH
  T195A2382993E4C332CC3D17731863631217B29C819A13EF2F4FACB4AA6DB37504E52A95
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  njRAT v0.12G/Plugin/inf.dll
- Size 19KB
- SHA256 9648ffd2eb53744c5f78dc8442a8bcbbe9831db1e198be370a62cbf9f51cd896
- MD5 cef141d894400bc2e0096d1ed0c8f95b
- SHA1 1bcef29980686dc4cf8ff13f251f1ead7ba6e2d2
- SHA512 794e7cc5a899407414bb3bbe2f2aadbfcacdeda2eb0381249b8dd5ed342534910b85b1450f509f1d6b36109efdc82eb3ef1eba36b76ce123b1034192d871d2d7
- SSDEEP 384:XioX36zZ00sK2qbc+LROMnDdU6cpobsTP4Fj:SC3wS0/9dcpFgj
- TLSH
  T1A792D805F3E86028EEBD1B329EB3C7616276BE274D2EC62F09D8715D19B23404A71B61
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  njRAT v0.12G/Plugin/mic.dll
- Size 50KB
- SHA256 b6fb6b66821e70a27a4750b0cd0393e4ee2603a47feac48d6a3d66d1c1cb56d5
- MD5 d4c5ddc00f27162fc0947830e0e762b7
- SHA1 7769be616d752e95d80e167f2ef4cc6b8c3c21fe
- SHA512 9555f800213f2f4a857b4558aa4d030edf41485b8366812d5a6b9adcc77fc21584e30d2dd9ce515846f3a809c85038958cb8174bf362cf6fed97ca99a826e379
- SSDEEP 1536:YmXfC5RemUFTxqPbSiQZrCF1HzGL17d8:YmXfCgFTxq+iQZrGTGL17d8
- TLSH
  T10033B4547A981DBAC11F123DACDB1261F6B18D64B223F37B1CE960F358833DA96416F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  njRAT v0.12G/Plugin/plg.dll
- Size 40KB
- SHA256 25d1969fb395caef8d9122f9befd597d0cb93a687d7703a42f06119d92520cc4
- MD5 a93349ba5e621cfb7a46dc9f401fd998
- SHA1 6668b353baa6fc7aaeb30b0cf86d5e878199464d
- SHA512 9d911ec49a0d79f2e9dd1d7d8aa119b18ad3aa74adf5027357bd2a7b187c8aee2be502debcdf0fb7b5198604a256935e91d5c2ff8ac2c32c46e1738a3d50612b
- SSDEEP 768:52Gyq9nJOybLlGvuWLgRDuB6VxGPZSCmjpUTsFlNBZyxzbIVF9dpfo7G9Rp6oXG/:cGyq9nJOybLlGvuWLgFu4HGPZSCmjpMb
- TLSH
  T11703B7CC67E48724D63E4B734A6177434BF99A264A42D53F4EE4F0F62AB37A48B00716
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  njRAT v0.12G/Plugin/pw.dll
- Size 243KB
- SHA256 9e0ccd6be2a8d6eb045363c44af34e7b1482856e64b4b9cfc3deae465e3cdccd
- MD5 11375fb0cee4c06b5cefa2031ee2ed6d
- SHA1 4c1a4f627494715197e233775ab4dae219b2df89
- SHA512 48e7de4d2496f39073b070b3de1370a7f4ad6837af72f5aff7e8ca6c9cffc3a2019651bb14138346779ad404e230c2254f7bda4cb9555638575ad2bec6c9c337
- SSDEEP 6144:+e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMOy:xxJ/JmSG9T8CEgdM
- TLSH
  T17734122E37524831D95FCD7A40A3F34263B68C619B53A61F2BE832461F735E58A42F72
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11
- Target
  njRAT v0.12G/Plugin/sc2.dll
- Size 12KB
- SHA256 3e5141c75b7746c0eb2b332082a165deacb943cef26bd84668e6b79b47bdfd93
- MD5 19967e886edcd2f22f8d4a58c8ea3773
- SHA1 bf6e0e908eaad659fdd32572e9d73c5476ca26ec
- SHA512 d471df3f0d69909e8ef9f947da62c77c3ff1eb97ac1dd53a74ad09fb4d74ec26c3c22facc18ec04f26df3b85b0c70863119f5baa090b110ab25383fcdb4e9d6e
- SSDEEP 192:3SDU/WQw9hM/BIlbzMmY3CX80B2/mZLks4LX08Lt6dD5DHqKlZTFzfpni48nafL8:3SDOOMJIpIm8/IQs4z08IdD5DvZTFTpM
- TLSH
  T10342080DBF48C217EA5C0B79167317519373C0560303EFABAECEA4F669AA3C516183C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  njRAT v0.12G/Stub.manifest
- Size 487B
- SHA256 835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
- MD5 4d18ac38a92d15a64e2b80447b025b7e
- SHA1 5c34374c2dd5afa92e0489f1d6f86dde616aca6c
- SHA512 72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
- TLSH
  T16EF0DCC1D188CA6AD73042A13A66E410A2AD435B19DD49EC74DC2ABB6F0BAC680C30F1
- MD5 SHA1 SHA512 TLSH
Score

4^/10

adware discovery spyware
behavioral13
- Target
  njRAT v0.12G/WinMM.Net.dll
- Size 43KB
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH
  T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral14
- Target
  njRAT v0.12G/njRAT v0.12G.exe
- Size 1.5MB
- SHA256 58bdda4552f79fd92c9934ca46738ae7f1aa5cf08b8ac41c47532825857174d9
- MD5 7e23b13fe4364aa8238cece97b6b2b0e
- SHA1 1fcee9b6ebc82168a69f84d8ae9bf47ab930bfa4
- SHA512 b3d36f95eb959890f63a709ff1c5787083f0f7c484883cfcfcbb970cf4cd47f66f27d20735d47f35a967f97b17ddfeb34017961f3b0beb0b00312234c9fc7519
- SSDEEP 24576:lHXxfXDrFyxWPAKVCEJl93mqzUcqUcSBxcCAW:l3ZRyxW3E2WqqUFXA
- TLSH
  T19A7539013D51DD51F95A2237D2DF806C47B99C116AE2E32BB9F8363964263E3BC08ADD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral15
- Target
  njRAT v0.12G/stub [SRC].zip
- Size 9KB
- SHA256 124d2c06b5cf48bea4f78c122b15ef9a693d4afb6e914f61c9230e3afc42efc1
- MD5 b76e8c4acd4069429f59335b74778d8d
- SHA1 97f9ee8e98a6743db20384d93d336341a4cd9e75
- SHA512 1c7db772af237a370e5cc6a187eb9bf0af6a3503b548443ac632a04139e1d502414c7eb79695ab8980fad3d9e845eae7f7407e0bfdff0cbbb3c439058454d9d7
- SSDEEP 192:h4VldJT6RVEzHCsgSnqU3v4xtE//919TsoxCL8zxLSSe5aUGS3E:CzLB7Vg2d3v4xu//9LsCCLCe/RGS3E
- TLSH
  T15F12BECC9558B26F4A3F507CF646DB213AA401DA32DA93B0AF62DB2D3F67C638C15140
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  OK.vb
- Size 46KB
- SHA256 28d5486f0cbe705253b2d0b28fb1111c6ba9b44e36c9d0489b7dd5e3288c76cc
- MD5 378e188fdfdc96bb041d52ef6a2c8017
- SHA1 18b483b28b5cc6495b60298cc896800f98d8bd6e
- SHA512 118ad7638cac699f74789f2ae6722da9f7417e3167ae653c805bb4f61c45e45a96a0be46611e53422eeb3c16093e43889eef61154dbc2f55c601437009cef494
- SSDEEP 384:JlWEYDc7abAnY/HHAaufcYbDl5EQBirbmwb1ombAYWm5WtKeEtrAweC5+YHh0SL4:GnkmWKrwa1WAggxhZVBRa
- TLSH
  T1E12381273D03257445BF8D196E2EA458F9D37EA712398CA0F48C41D10FB55EDD2A0BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  njRAT v0.12G/stub.exe
- Size 49KB
- SHA256 17f15d995e24336d0594731d548d51c7830a67a41cd081fed2b28a3079f57719
- MD5 f26f453f9b893a2c8bd6ed9c9a08d85a
- SHA1 1781d3be1f658d3cf057ddabf08f3a52eb972f92
- SHA512 067e718e4b2d2cab6184763350d2cac1c928983168dd981fc81e0ad01c7230c698a5eac3a9954280f579f0bc525f4b6a75fd34b31efb7395805ac4bd75391023
- SSDEEP 768:iNt5wqwd6swNo9RGXCwVjwfv0NjeRBUjYcse5qD7ulm:iNwro29Qt6ENW7e5qD7u8
- TLSH
  T15333600B63ED6DA1D47D0B753B3347C18379DD064A13D62E0DD860996ABE3837A01BEA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  njRAT v0.12G/stub.il
- Size 342KB
- SHA256 7a23b2a867b0607b9d16a6541cb5913af0fdf03d4caf5772b9942fa5f7928a7c
- MD5 477908bbd6ed1956fc8c3b1f054d1ae1
- SHA1 39cc84db4a9f000d8c812140b3f4d3949a4d1897
- SHA512 208f38fa2f5314aa74e468a7a146c5919469f7cdea33d2abb3edd3e7b30f85884e16b76fc14bfde8d253364252245b5b1e4d77777152fad9b7ad2ddecd147994
- SSDEEP 6144:z4jkYLlOW/QpeCeoBQASQrCX743hDyrxznEYy7JhjFhXEFvUpZaz6tt:z4jkYLlOW/QpeCbSQrCX743hDyrlnEYu
- TLSH
  T15D74012D82289585D4B2601DBB72CB46F7AF52270F727C963CDFD654BF32289427423A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral19

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Drops desktop.ini file(s)

Enumerates connected drives

Contacts third-party web service commonly abused for C2

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19