General
- Target njRATv0.9d.7z
- Size 31.6MB
- Sample260708-mbzb1set3v
- SHA256 d140d65ddeaf724ddde989dc0073f364d8b684c4664cd71a0f2edfceee2f2eaf
Malware Config
Extracted
-
spynote
-
[SPY_NOTE_HOST_OK]:[SPY_NOTE_PORT_OK]
Targets
-
- Target njRAT v0.9d/Resources/Imports/Gsm/GSM.dll
- Size 5KB
- SHA256 623f780cbf8a2a7f168b28ff45ab189f691f608fb7597322ebc4f68f3ab0f90b
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target njRAT v0.9d/Resources/Imports/Payload/stub.il
- Size 730KB
- SHA256 7b20a276931c8625b39ebc46017c7e4d4a7bdf319b9f451231d777b078b0cd6a
Score1/10 -
- Target njRAT v0.9d/Store/Abrairnotes.dll
- Size 55B
- SHA256 321fcf894e5a1853ffb430624d3085f04025563e8e5d8ae1c9c28dbce93d5f93
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target njRAT v0.9d/Store/Abrier.dll
- Size 79B
- SHA256 ed0aa6ecbb2d5d6ef3b8431d13d4562d89c2e1c88636c22dbbbbea81e32f913d
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target njRAT v0.9d/Store/Apraircam.dll
- Size 83B
- SHA256 37d23694738615464be8a3234bcc59592987432c8863db67e30385b8bb3ef450
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target njRAT v0.9d/Store/Bipe.dll
- Size 65B
- SHA256 c1c8afde84694f203ebb49766454ce17179e32c06a0bbdd272bf598c0d9b7c0e
Score1/10 -
- Target njRAT v0.9d/Store/Delet A.dll
- Size 83B
- SHA256 fd8802c66f18b5d7175bd3eaf628c652525605be88b8149a37e7ec731f3ab963
Score1/10 -
- Target njRAT v0.9d/Store/Delettemp.dll
- Size 199B
- SHA256 5cbea0f270bc1d57e2231a4d2d5e5d8323710d5757e714d5559e90dc86432c93
Score1/10 -
- Target njRAT v0.9d/Store/Destentrnet.dll
- Size 33B
- SHA256 0ec9ad05ab5eac77b92dcdf1b2f8f563d626b9b6a64619da9fd64aa375f97638
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target njRAT v0.9d/Store/User.dll
- Size 923B
- SHA256 60f8c81016cd8c5c7a77ed2a43699bd1bac357f3ea54c8c9849ee6cbe77aea94
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target njRAT v0.9d/Store/dcr.dll
- Size 37B
- SHA256 6a207f770478d59da0d2aa43a9719ef05b3f85c8c700400746ca3ab0463d08f0
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target njRAT v0.9d/Store/destedmous.dll
- Size 160B
- SHA256 b7dfc64c735cb92f98937b9bb77cbea0f8bc6bc94e3ef14155b2611a36482e25
Score1/10 -
- Target njRAT v0.9d/Store/dromous.dll
- Size 67B
- SHA256 32c699ebb7394ddb2d56f092ef10fde4d9f4bcf808dbe11bad777e7bc73f7aae
Score8/10-
Boot or Logon Autostart Execution: Active Setup
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
- Target njRAT v0.9d/Store/infctcmd.dll
- Size 53B
- SHA256 e677fb6d2da669557df503eb45de14c3d3acf5509bb2005fcc4be39ac975f2ae
Score1/10 -
- Target njRAT v0.9d/Store/laxer.dll
- Size 58B
- SHA256 21ab187279045e81f550c170fdc8b73117f4e4dc2e608bdb80865540264fdab6
Score1/10 -
- Target njRAT v0.9d/Store/logoff.dll
- Size 37B
- SHA256 2036a894b2c0eaeb684a56b5da1e2bbf992ff50fba536e606fb1adadf6cdec4c
Score1/10