njrat | 75409502dd5c1a2cfbba01879c8f18a4f8e1fdef047b7aa92ed6e3d83d1eb0bc

General

Target
UpdateLoader.zip
Size 124KB
Sample260615-m5vwpacz4k
SHA256 75409502dd5c1a2cfbba01879c8f18a4f8e1fdef047b7aa92ed6e3d83d1eb0bc
MD5 35bfd9b253e6b8cf49b4ce823ef05e02
SHA1 c06892b407b6f4a35583f092df14a9d2d1fdc2b2
SHA512 2cba82a200f50697ecf1ade250e8209294f5ecdad43ab7665f6b405bd6850f71fd06e2628844e9bfda23733d1442dad277588dccb8438f69bcdba9f88dfe7508
SSDEEP 3072:HyuaEn5kLDdNmAvygWRrfcNCvvBkXvWpJ4ebuZ08ObUtf:H4E5aNmYygWRVvkvWP4anbUx
TLSH
T17FC312EC6B67C624CCB3346E5948A8A78228EAC35C0665BA0FD141EB0CF63CFDD55930
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

C2

63.176.170.12:1337

Mutex

dbae904fde8f2aa44f306dda3a3b78b9

Attributes

reg_key
dbae904fde8f2aa44f306dda3a3b78b9
splitter
Y262SUCZ4UJJ

Targets

- Target
  UpdateLoader/BthMtpContextHandler.dll
- Size 52KB
- SHA256 4ffad3183133ff3490f396838d86ce0c64a672337333d00aadcbf49984728a5a
- MD5 220fa4a0391316bea0bfe5210f9c01e9
- SHA1 f3d9d093c9e3a98775c2ddb451550b5592c0ddf0
- SHA512 205739d245212de265f6d52665a8ddf44979e6e171a6b7d1842ae59a2e6ec2b74947f772d17308baa588bb8841c02a86ac9fb8a0be9dc17777b3c32e71a9099d
- SSDEEP 1536:ChZ35oO8HHR+I4n44hbyyTt10B1O8EtDW92xQu0:yZefHHR+IgRbx8ya92yj
- TLSH
  T192332B7D96AC18B5F27712BD85A30A20E632742A171186DF716C836D1F3A7E05E38BD0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  UpdateLoader/BthpanContextHandler.dll
- Size 204KB
- SHA256 f8230a66edcb343e542ab4b4b0dfd3156db77c2ec35ea9d81633a97f64899e57
- MD5 1e345a3fb5bbc97aa6cccd3f42231d56
- SHA1 ce6b1cb0a2806b10c2d374d02dc3e17238950c82
- SHA512 d24163a878ccf919b23ed802b3136ee9636ed3207ce0bb0a633af5d36dac811ceeb65febf4d28ad18474b8ae16db6484db8482439b1a377f402980f058de9dda
- SSDEEP 3072:cVmpAo67bIMgA6LLFqKuVTeDvP5A11Ix8Z+EUN3S63dvSXNI0JMm:cVmKN77g5Fq7TeD0Z5UMNIe
- TLSH
  T13514B3DA7E78106AF065547482934A37972E7C211BC213DB21E4B2A9EF332E8ED3D750
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral2
- Target
  UpdateLoader/Loader.exe
- Size 55KB
- SHA256 8d0b0be3fe34cab2f83649ed46a208e17536d598d04de73597d3f0ea4a35cb1b
- MD5 f35b3b25eb6767fc6cf9f1a16464d2a9
- SHA1 78885e86a0680e9c1d00216ffb01f27397f2e6ea
- SHA512 c7678b95fd114c5466a2cedbebfab192b853c7d93c379ad5c9af8c20f5b1ad91341e6271385b6eebe29fd3c58d66b6e102718fb1924c39fd27c63233ce062654
- SSDEEP 1536:GBWdMDncNS9yqNOdDvwsNMDVXExI3pmmm:1dMDnNUqYdDvwsNMDVXExI3pm
- TLSH
  T160431744BFEA4A05E2BD8F3468F645150634BA63E532EB1F48D668DB17327C58C80FE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery njrat persistence trojan
- Family: njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral3 behavioral4
- Target
  UpdateLoader/bthpanapi.dll
- Size 56KB
- SHA256 ebb8ac77dcb848333ba50eeb410c3e4e5dc71761ba64150a11e9c35351dcb438
- MD5 e7fdf1728737d62012c7f7c5c3ce940e
- SHA1 5ba3b08a6958605b24d552627111e5c732b90bd9
- SHA512 38d1e89761a6c6a49f7d38e3a3010d56adb5ad97786b113100d4b5a33d95743810ed9003ab530e8cabe5be36e5a7b7dbedb8e93ec11d6f9a456d87c082c42894
- SSDEEP 768:8jdqzQ5xLlOsxzux4dohNIn+141y3SX9bCrSzl0qj5etlE4:BQ5xZBzsMn1SWb4Sz+qj5Glf
- TLSH
  T152434A6EA7A41075E0A2427C86630E52EA73F47817625BDF51F0C2AD0F673E05B39BC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5