f2dba8ca20003f44a5c3635f8768dddc48d5996c8d04cf5b04610b215a905c10

Sharing

Copy URL Twitter E-mail

General

Target
njRAT 0.7d Horror Edition (1).rar
Size 13.3MB
Sample260623-v84l1aez2t
SHA256 f2dba8ca20003f44a5c3635f8768dddc48d5996c8d04cf5b04610b215a905c10
MD5 638866746f10720e19e349aea11c518c
SHA1 72003e2603f03d8a98f31a0a6272cf268f70ab98
SHA512 1e84c7a10cb612ab940ec9b8c45f4096f2dd8ecfede9881e9e6d7c3a98f2ccf49e400ef0dbc3450491f8c20f6f01c749fd68329427ae302edbd10b49d3a39e5e
SSDEEP 196608:huDXOzWf31zruTNMaX6886R1izqhS8pGCtpRiqUpvdkGIpHAbX90aGtzNvrJ9zht:QvfFfUWsv1izO7lR7UpNIBSSrtJ33
TLSH
T146E633A1F76ACBB3807523A3ACF079FFE47DA75B6346B2A34F3508214664DA8346145C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  njRAT 0.7d Horror Edition (1).rar
- Size 13.3MB
- SHA256 f2dba8ca20003f44a5c3635f8768dddc48d5996c8d04cf5b04610b215a905c10
- MD5 638866746f10720e19e349aea11c518c
- SHA1 72003e2603f03d8a98f31a0a6272cf268f70ab98
- SHA512 1e84c7a10cb612ab940ec9b8c45f4096f2dd8ecfede9881e9e6d7c3a98f2ccf49e400ef0dbc3450491f8c20f6f01c749fd68329427ae302edbd10b49d3a39e5e
- SSDEEP 196608:huDXOzWf31zruTNMaX6886R1izqhS8pGCtpRiqUpvdkGIpHAbX90aGtzNvrJ9zht:QvfFfUWsv1izO7lR7UpNIBSSrtJ33
- TLSH
  T146E633A1F76ACBB3807523A3ACF079FFE47DA75B6346B2A34F3508214664DA8346145C
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  njRAT 0.7d Horror Edition/NjRat 0.7D Horror Edition.exe
- Size 15.4MB
- SHA256 bb35eddc6b3ccc8aae668176a3987be76ca66c3c0c01074e5ee9cd7d145ce6ce
- MD5 dd411913ab79512e94920f3bb8019334
- SHA1 463c4fd39c21be32970febd1447fb472b419c89d
- SHA512 60c2d87dafa3726e175ec48b1899f3256a1c884b35ed725469f28a403b7a928e67eab2413c187f746887ca588676c94f85b304553824afa9bff6b9805b495d2d
- SSDEEP 196608:/jTb2kYfaKqgAyoSxX3NYeOu2kYJBnnim//7uVtFZ03MtV0Poiv5m:X3JgA+9ecWBnnim//7w03M4Fv5m
- TLSH
  T1E0F6BE02B292D911E07E16F4D6E28BF606B5BD0EE935927725903F29BDF27C16D027C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  njRAT 0.7d Horror Edition/Plugin/Clip.exe
- Size 13KB
- SHA256 88b7a47f63f149d273015f4f6ce9ef8c5a731b6cf19db7a95220298603000b8c
- MD5 fd829592c5abc1361c2f5e81b2678019
- SHA1 91b6d23bc43332bb7fee1b2d924a5c26a86747e4
- SHA512 4e3e3b3cbfc2c25ac23399d15dcb6e7b40e5572fe9e5e741152f20589cd94de390fe0bea4abfb53ff427c6dec366d41a43a3a67ccdbb34c139f781be0b6b6c34
- SSDEEP 384:Gr+hl2K2kTjnbkHWUWb1Lc4WrYk90/RxLKNrw:GrYSWUWbJ5//KNrw
- TLSH
  T15952181153E5C37BCDFF1AB15C73A78202B1DA469526DB6D98CC905A0EA338807D3BE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
behavioral5 behavioral6
- Target
  njRAT 0.7d Horror Edition/Plugin/Lock.exe
- Size 16KB
- SHA256 c9f03a39789f7322ae43604db6ce7da86765ad4b13207091683cf47bdea8de12
- MD5 683bcb1f86f4410931abe39a63eb7057
- SHA1 d338aac5ff479fc94d3c840e862665de1dac8c8f
- SHA512 60b596947d93fdb196fcf338af92d26cdd82396283316352ead078ce1a85943bb85264901318f7061e6b0e49058ace521831a9275c025526373d9168c757cdd2
- SSDEEP 384:wi9N5yF4C0n7QLweis5rul02mXlBbVVaXI:wi3kWv7UB92KaXI
- TLSH
  T14F7228A18398D37BC8FF1FF68D73220006B1C7514917DFAD5C9D616A4AA73588383BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  njRAT 0.7d Horror Edition/Plugin/Screamer1.exe
- Size 844KB
- SHA256 00201a2fd4916193c9c7bbba7be6a77fa5876085480b67da4e1228fd8b23ae5f
- MD5 8cac1595b184f66d7a122af38d5dfe71
- SHA1 e0bc0162472edf77a05134e77b540663ac050ab6
- SHA512 88d3753ce73bbf95ee1fdbdff21eb9331e59ca92cfa5c489f141c07dc90871e3032e331c9dd77b1fec4522add3ac25c51d5c699d7801a5343dd2ae447c60f8f8
- SSDEEP 24576:Twbdh4Y2uoLtciBtgFD3O7iPTr8pYocr6x:T212uohceaYg
- TLSH
  T13E05DF67E0040E32C499933E2863773243345C28EF670B2456D8FD696ADF9F86769BE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  njRAT 0.7d Horror Edition/Plugin/Screamer2.exe
- Size 345KB
- SHA256 c1badbacd2abe44fe4e8685c8eee7e983bf8b6780cfca03ae31f8fcebc98b1fb
- MD5 8efb7339fe13cf8cea9f6445776655c0
- SHA1 081afd73c757c83825cf1e8ed4a4eab259d23b97
- SHA512 2a37e74aeff17b4f435d02a30019a017a4ff4fa29fc898229f6195876f53b38154c063cf052deebcc06785650f875d67eeb0de372a76df3c4e71bd4fc0392956
- SSDEEP 6144:1sp3sCQ1AWnK1NOZ2l8iQojWaCZ0pak0l1aNmN4/nzNRH91FHlHH:1Ii1Az18YDQ1aq0ok0d+nzN
- TLSH
  T182745A27E1050E32C488833E64A3A73547244C29FF670B1466C8FDA86EDF9F4675ABE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  njRAT 0.7d Horror Edition/Plugin/Screamer3.exe
- Size 280KB
- SHA256 5dc4f19b34a738b4eef99c1229b2c7e7492040819d92ddbbf52bbde2a600c2ed
- MD5 dedabad13c1c4cc92c4ed2122473eb8a
- SHA1 a13385641ddcbdc371dce3607381883d52ed9822
- SHA512 45b66665cb3e484c82775c9972f444b1d8fe6f7ef5a55185a3c071f84e9f5dd2a039c9f9e26392e950585cbf965b987df9c789106bddcb35ee55ad0ff91b190b
- SSDEEP 6144:gk8SnpZqjGNklsppH1eSqkeJRH91FHlHH:gvgZqJmTeSqkeJ
- TLSH
  T192541727E0050E32C889833E5463A73647204C29FF670B1466D8FDB86ADF6F46B59BE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  njRAT 0.7d Horror Edition/Plugin/Screamer4.exe
- Size 961KB
- SHA256 0d635f035cdb2fd3afda768cd631481ff980957b614a3cf3fca6c592c6c06470
- MD5 4723c3c04794c09bbcb6e03f48440f15
- SHA1 a5ef69c9dc9eacc2099d9c239146a0e360f1837f
- SHA512 5b68e1cd3d6bb85b5f449014cc288423faea76ff0ecf8834047dac1ed6e84c4d858a7ed23abe3625d781391f636893736bf5c00474ad0995e75611c1557c5c4a
- SSDEEP 24576:V1ubnylucMp90zjW7tDVF/ZeHr7aNnX/Xq7PU:V4bnylucasuDNnX/q
- TLSH
  T16F25EF27F5010E22C889933E6463B73553204C18FF670B1466C8FDA869DF6F8A759BE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  njRAT 0.7d Horror Edition/Plugin/Screamer5.exe
- Size 997KB
- SHA256 8929d3b749ff91527b8e407eff6bde4bb0bb27739313b5c0db0434cbf700dbfc
- MD5 28aaac578be4ce06cb695e4f927b4302
- SHA1 880ab0560b81e05e920f9ec1d6c0ecf5e04eaa7e
- SHA512 068698bda0543c773b36830f6760456e40e9046d9d20089ad88cb646ef5c7bd6c6716c6d59cfc7abd5bffb9129f5a7076e2f9c9b321795f224923f00b7b91374
- SSDEEP 24576:xcWLYmbwnSTHLmB1wS7pmYSOryHwC6FEUQ09E4a66:xFsoHSXw2S7wCqJ3
- TLSH
  T1F825E06BE5000E32C889833E5473B77543208C29EF670B1466C9FDA96ADF5F86719BE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  njRAT 0.7d Horror Edition/Plugin/Screamer6.exe
- Size 583KB
- SHA256 d88f5b00da5f05ab7f55fd7c414bb56aaf47e9f51365aaabd71f3ace3cc77523
- MD5 320b1115164e8b5e1316d86eb29cd299
- SHA1 bc046d8b14359a7a2bebdecbb819e76c47d84d1b
- SHA512 fab558cf31aa79caf8e4f6e5649e4e484de3e29bae1386aa61749b70e8c791d74b01fa964501d4755c7688d0420e932f30e36699a2fe4488fae82ee23558afd0
- SSDEEP 12288:Y7ogwYqbE3DMuR6BlTTnn9ZOKp0Ac9fEmtdyaukNU9ad:1gIcou0Tnnjr2fEmDNh
- TLSH
  T122C4BE67F1050E32C889933E5463A73153204C19FFA70B1466D8FD686ACF6F86769BE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19 behavioral20
- Target
  njRAT 0.7d Horror Edition/Plugin/cam.dll
- Size 99KB
- SHA256 881d5afb9aa4799c73e75dcd28587dba85dd844e4137287ea48c6b66525e2638
- MD5 8ce3060686462fc72ece2701caa13e3b
- SHA1 19fc9892200de4db332ddd0c14b4b6fd9a35ccd4
- SHA512 ef38e00b054240a0d4747bfd79db860015ed027735c360de58af6889a69482109ccf74770608a2750542457ac38aa79367431ff6ca77fae44d7e3a7023f33a17
- SSDEEP 3072:31IL2SeOPGmBUMqtZabredepzZxgUPWeJP3:w2Sm/MqueepzZxgQW
- TLSH
  T12EA3091A77479B17C54C5A78C0EB2B0403F0978A6373E7CA3F6C15ACDE633425E5A68A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral21 behavioral22
- Target
  njRAT 0.7d Horror Edition/Plugin/ch.dll
- Size 44KB
- SHA256 7032cb496f866ec1c9304f2c3cd8859472168838a11aba1571f51875a75074af
- MD5 11fde8a47647c3bc98d57f3a9f3a97a3
- SHA1 e813c17973e77b7aa22b9f539c3c97c624acafb1
- SHA512 1401f40569db7679014ab282477a5560b3bc6f51284e501e0e878881522db102b448566bae50ab6c1027a196de410a9ac8770dfa2208d14e5dfcc3c05e766763
- SSDEEP 768:BZXGgq41SLdRX0vTeAMtNDkpUrpDwxRcNDfF6a2Txj+izh8RP3ABkP0:72gq41SLdRX0vTeAqNoC9kxmRfgrCs83
- TLSH
  T1C0238215B2C74723CA1C65B180EF356113F2978A5B33DA9A3D8842FD4ED33529F86B4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  njRAT 0.7d Horror Edition/Stub/Admin.manifest
- Size 498B
- SHA256 8ea63e8ae4a6ca4769da44b9d934dca248c2ffc0169ae251bd0f6eadca457f24
- MD5 ae08a3b3c72a07aa6b5babea340edc36
- SHA1 cd758742b1872eddf9ffe0bc715097c467ad7f64
- SHA512 0cbd2abf49b1155ce2c0f4645e20e1c40c8dd2d78f43276e01b14d5bdf3ba0ea52bde985c215868fdfe3ec61e6e4f83555394ce5ef3ee82a928bd26e413a0fcc
- TLSH
  T14EF09EC1D1C4DA6AD73051A13A66E010A2A9435B149D45AC70DC6ABB6F0AAC5C5C30F1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral25 behavioral26
- Target
  njRAT 0.7d Horror Edition/Stub/Stub.il
- Size 566KB
- SHA256 ad630e3c023a2d10c61f3d1e6d14e60b4e691bf900f2c3b42ac1aefd16d2c12c
- MD5 ddb962ecf023ba1a781a3241f6557866
- SHA1 f63349964f326569aebf2546be02b044386ae103
- SHA512 46f1ce3c8ef81536dc95305d9b4c617227e810028999718019629a657335e2fd60866c25188e5b419b49a89c6a0bfab59116d21a4ba8906576373206bde850cf
- SSDEEP 12288:C2q9K/m5eKZlRaoTTTBiBhFd5OghpziZDYP2Hz/oHRe+uJhH31C/AEuAw5wuE/uP:QZ
- TLSH
  T10EC4FF2D8228958AD5B2711DBE72CB46F76F42274F716C967CAFC254FF31288427423A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral27 behavioral28
- Target
  njRAT 0.7d Horror Edition/Stub/Stub.manifest
- Size 487B
- SHA256 835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
- MD5 4d18ac38a92d15a64e2b80447b025b7e
- SHA1 5c34374c2dd5afa92e0489f1d6f86dde616aca6c
- SHA512 72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
- TLSH
  T16EF0DCC1D188CA6AD73042A13A66E410A2AD435B19DD49EC74DC2ABB6F0BAC680C30F1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral29 behavioral30
- Target
  njRAT 0.7d Horror Edition/icons/10.ico
- Size 97KB
- SHA256 b5c9954fe4f300e11226301e4fdefd35a180a9dfd38385ad8448ddfe07447eb0
- MD5 1cb45cb1fc481e43d11f518a12c007be
- SHA1 b01cce7784e27405a2f5223c51210cc4f9cf8b4e
- SHA512 f3c835422ae8a5b905d623902f5987257d03c9b76201394baf39d6f3441cdbd737215e0c90182b21abc39e41d8ec874ed63fd787dbe09f1fe27c07b5fe7751af
- SSDEEP 1536:ltNLBXfpUplphppgpppfpmppXptpHpopnQpd:jXfpUplphppgpppfpmppXptpHpopnY
- TLSH
  T19AA3FD3E276AC066C9E1403CDF4687FF162A0D69E1D2052F2664FEDEB8FD04C2679592
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Checks computer location settings

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32