Extracted

• • Target
    njRAT-main.zip
  • Size 9.2MB
  • SHA256 da8d6067a5279e9c711fd894ab493e43c712b2dcacf97e9ad3e97012afa67be4
  • MD5 e0e6d8a096419e5dc9b5c1027c62e44d
  • SHA1 6c2f3495ea221757cf15b81084942fed402247d6
  • SHA512 6448790631e17d2a2be176f7c18527b8aab0b33f9d6aa4f0078e99d2ff075bfdd69af5690cc75e63b96fe2e107a35745e08b5e40c2925839db09c7297c954fe2
  • SSDEEP 196608:Ax6bq2uUO3c367RYvLmVIJqlximjOHDTZDXPe5r+ABASckIWX4i3:3bq2u+367KjmVIExZOfZ6Eo7eY
  • TLSH
    T12FA63340E0B69D10FE74247E383EB187C3197D8636C8FF4A418979779A2B57B66988CC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  mybotcredential_accessdefense_evasiondiscoveryexecutionnjratpersistenceprivilege_escalationspywarestealertrojanupxadwareransomware

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Uses the VBS compiler for execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2