4b649c32035e383706673ffe6471d6c711989a206d6f96fdd905dda207a5f0cb

Sharing

Copy URL Twitter E-mail

General

Target
NjRat.0.7D.Danger.Edition.zip
Size 15.8MB
Sample260820-sf6jsasyhw
SHA256 4b649c32035e383706673ffe6471d6c711989a206d6f96fdd905dda207a5f0cb
MD5 18b9e23e509ff221ebb1b8a0ce4bc82b
SHA1 bacab6a415515e94b3083c4f7ebda6a82e1d4c7f
SHA512 26091095397f3b229439bb4838f3321de63b9084beab20391a3f85fa8038836d9d0a96a44c7de1d860b182d0b072e0c752494201eb50fd36444cfe742d310ca1
SSDEEP 393216:miHDYl/45B6Jh6jtGFHAeFWs2AUSTPnUGeOiw6hlVoTzQaGQLMGqE5i:DYl/4r3g6C1UGGw6hlZrQLTqSi
TLSH
T17EF6332A4A16705AFE27731A50EB9CF0A7A609B6B159FC5D2AC830D0C50FDDECE5184F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

execution persistence

Malware Config

Targets

- Target
  ER/Abrairnotes.dll
- Size 55B
- SHA256 321fcf894e5a1853ffb430624d3085f04025563e8e5d8ae1c9c28dbce93d5f93
- MD5 cad085eb4a51b05d3f2905c9a2996fec
- SHA1 f2c6be581eac7a2580666fd3c589f15cf6599996
- SHA512 f6e50801d3de71926568c9b225b2c83607269b716aa18b9f9af417dbb32e7160395c1f53c80c07bef2b50209ab1e92a5b6aaac46d36ab6f14e62b8e83e1503c4
- TLSH
  T14990025D5062ED6F11A5A6814087849CB16FC0D61C5784464407057D8A454415449C49
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  ER/Abrier.dll
- Size 79B
- SHA256 ed0aa6ecbb2d5d6ef3b8431d13d4562d89c2e1c88636c22dbbbbea81e32f913d
- MD5 5514b7e5a95e10c6d37278bb973651b2
- SHA1 44049d7456b90ef04b9c5c414167f1594f54bbf8
- SHA512 3b98f20638cd63612f035fe331b6bdb3ba1cb737df277da762005eb90f548f72fff43977ab502daa105ec571011e277bfdca0f34cafbdac4509ad53c8f175b56
- TLSH
  T125A0112220820A02200A88E0A0AAA080320BA3A30383ECC8282BC0308B803EC80E8823
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  ER/Apraircam.dll
- Size 83B
- SHA256 37d23694738615464be8a3234bcc59592987432c8863db67e30385b8bb3ef450
- MD5 cc795c9c4a83aa1ede067f96f1eb8d15
- SHA1 32b8e1c43787353f7d87514e279288aff5f7d4f6
- SHA512 ec0b8f6600b2b0443ea6f271fcf16804e380b6f51f3f74997dc5c53ed28ece8ece58a12686b451532ed31941a67fa075305314fba7fa8555a7fb8cf6424c6fc5
- TLSH
  T1E3A0121221814A01200C54B490699080304B62971343DCD0182AC13887C03CC80C8407
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  ER/Bipe.dll
- Size 65B
- SHA256 c1c8afde84694f203ebb49766454ce17179e32c06a0bbdd272bf598c0d9b7c0e
- MD5 4992e2814a8597fb20b5282e568a032d
- SHA1 e0e1bb5cdcc6eae4714ed420e158717be66c45fa
- SHA512 dfe05b7db512c82b5c0d996c13086133ffd70547c69f819486d311aae3d687516bc4e412f8ef7c7755456d84e37ce33d55ff30b71208335144194fc2d67db903
- TLSH
  T1AFA0021261D11E05900C7AD8E99BE4C0345B82C71347A9C8283FC474CBCBBCD91AC91B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  ER/Delet A.dll
- Size 83B
- SHA256 fd8802c66f18b5d7175bd3eaf628c652525605be88b8149a37e7ec731f3ab963
- MD5 b256a2a73f8436243481712965f3fd48
- SHA1 696657223bc7be99c1cb275b2501850c03581001
- SHA512 aae2b68303ce9fe22f260f31f9fd5ee7edf4bdff7e99372df35a1e0d0a5a3714a915c23d8d68a97417cc5a3c431d0dac3a3c289aa74764308e63709b99d94dca
- TLSH
  T1B5A009059C4A0586A1291893208557E2A61649956F589A41028FA0E667C73466205459
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  ER/Delettemp.dll
- Size 199B
- SHA256 5cbea0f270bc1d57e2231a4d2d5e5d8323710d5757e714d5559e90dc86432c93
- MD5 5fce1e96bf39cd18ede1c35b48a90b43
- SHA1 e8e323eac6292b077c0b9af93c89dd869477a4a5
- SHA512 bd5fa97a9c67c6b342569653362b6896b7eb82be561695ba46b4975a3d0dfd2d3d3ed108e7ae4dbbf1ed7a4deeca2f54fc2477a946b124a6e5819300b553b0e0
- TLSH
  T17FD04C233019360EB04C4D34C1B49015161DD364593A5AD1CC91D8107F175C4466F3D8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  ER/Destentrnet.dll
- Size 33B
- SHA256 0ec9ad05ab5eac77b92dcdf1b2f8f563d626b9b6a64619da9fd64aa375f97638
- MD5 0920bfe00503b41bc09350f6d60412e9
- SHA1 4ad929b21d7f51fc414619fc7c7a6eb702ac1aba
- SHA512 19f56252682e633293f08207cf88af0003c1959cfe102b66e59f8b4c76b4dea11830d77073cef35bf9f6f4e1200d0a98e78240622956a1cf614ccd6fe8cf764c
- MD5 SHA1 SHA512
Score

1^/10
behavioral13 behavioral14
- Target
  ER/User.dll
- Size 923B
- SHA256 e4125f396993ea0876f3ffa9bffc46134dd20d7c8e4d077ddadee67b6ca33abe
- MD5 456c3e1669d900ebe41355349deb28e0
- SHA1 57d3afa70c9cff74b74366fb6d34bc57cf01312a
- SHA512 7300fa661115e8606a766093698ee5c760162293d65216a26ba54fc83cf866bcc16da6e84aa304c917106eb94c0f5cce5c95b1d0fb1ee2dc1c1b2f0c631d02df
- TLSH
  T13611005EE00E362D2D5747F53C559485570550C913C579941475419CB55D5709155811
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  ER/dcr.dll
- Size 37B
- SHA256 6a207f770478d59da0d2aa43a9719ef05b3f85c8c700400746ca3ab0463d08f0
- MD5 1cbc3a2f81d4259e3bf61249711fec81
- SHA1 7ba62560df466c6dcd794854a25aeb5b088968d8
- SHA512 74ba85a391d769686c95001af6e29f9fe2ccaa4d119247fac31e65c8becda7be1ea9fa3eb9f2a06c1d48ac4b580ad8e63c14e06d94e8dd07b26129df7f1f4bc0
- MD5 SHA1 SHA512
Score

1^/10
behavioral17 behavioral18
- Target
  ER/destedmous.dll
- Size 160B
- SHA256 b7dfc64c735cb92f98937b9bb77cbea0f8bc6bc94e3ef14155b2611a36482e25
- MD5 86db8aaa81d53ba3647175fa02aec88d
- SHA1 27277b6740e72bee1efdc2b21a6b4fb147e493e2
- SHA512 a846322ee5037dc8d9c8aa5be8badf7f295250c6374702d0e5e4972ff6db41fdd8f9765ed3313e9a083bb07a66d096c03f38a375ab5aee2b28a16c9d21527d4b
- TLSH
  T1EDC0803B600699049C075F65204964DD773F21D30385CCC0445754E4DA413C9D17CD2F
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution persistence
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
behavioral19 behavioral20
- Target
  ER/dromous.dll
- Size 67B
- SHA256 32c699ebb7394ddb2d56f092ef10fde4d9f4bcf808dbe11bad777e7bc73f7aae
- MD5 1cc401169ef8cf1e8977f4e92dfe72c7
- SHA1 d04c32295d4e563978fa0abb1b32ba52699cb08d
- SHA512 076eb06d9fbf8bf1d6a4c5043d803ee7b5cf0307253de6358f8ea70e0bf240f5ae2208fbe9a44778e782e29c54751936f393ade6e292064d2134ed223506866b
- TLSH
  T17BA011A2200C0A0080080CB0208B008A382A20EA0322EE8A800B82E0AAA0288800CA0F
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  ER/infctcmd.dll
- Size 53B
- SHA256 e677fb6d2da669557df503eb45de14c3d3acf5509bb2005fcc4be39ac975f2ae
- MD5 b72c081752f133cf07327f33fa4f819f
- SHA1 19d19299a17de80c1cb97df79b8a659f09fd958a
- SHA512 876dfe36eb1d47d49916512b3634bfb19a0b43f90b7348fcde4246e93dfef1521b59b4299c09071521d2d83e92385faa93557b18764e364ae1bc78cab56443eb
- TLSH
  T1209002A916421A14500D8E60A059E196682EB1DD41105B80504F75D4C9D1E4C8254D71
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  ER/laxer.dll
- Size 58B
- SHA256 21ab187279045e81f550c170fdc8b73117f4e4dc2e608bdb80865540264fdab6
- MD5 e67ee9fa20340544e65bc2cfba5d8192
- SHA1 7b49b96219d3ef4a2660a0deb6d70df69d73ec6f
- SHA512 b1786afb5f50dd2001862e0a26fccba91aeecb338a14ee55ef0a09f5f0efb0e7e68a52e0c1b545032930a42668a27d729d334abacb1e0c85b1583887a32480a8
- TLSH
  T121A0028638050F4C118C4856208ED1C075BF10C74A50D9C2512FA0E0DA8C5D9859CD5B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  ER/logoff.dll
- Size 37B
- SHA256 2036a894b2c0eaeb684a56b5da1e2bbf992ff50fba536e606fb1adadf6cdec4c
- MD5 3d79995c5af417fb5b26f78b02000f49
- SHA1 7e1f39492457eb8be9c0b1bed130f1b205b41ad5
- SHA512 21a745ee1c5b8482573d619d54daa71c6b35095ec0521c1cf97c8d1e6470f236e94e0688d013c597699ee9af1df9be129e8b0e0e39b25a725daa7e9b7b0d92e6
- MD5 SHA1 SHA512
Score

1^/10
behavioral27 behavioral28
- Target
  ER/maltExe.dll
- Size 60B
- SHA256 4f553023c9fdfea5f806c86d6bdd40d94348843d4a4efd91dc952a53229a4358
- MD5 94070806e01c1ae7fe2aae46d929387a
- SHA1 0fcd747b0fd81b01ea54fbd849388b6e49ff1698
- SHA512 1334b73fadeb074ea1f31f379bb76f4274af5ddfc48a5c28139e766202c373a8b25e0ba2105537673bdf5de9df625dcbd870ef0b8a4506f9674c88bcd2595e08
- TLSH
  T17DA002472442DD3558391959208FB894749B01CA43DABB90244B44E08E817C8B089DBA
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  ER/past0.dll
- Size 183B
- SHA256 71385e3fb017bb452466ab1ad8764950c14a7af856d0ee8c147cf8f7f073b2ec
- MD5 ab45b6913751e20d60d6c9a44a229a66
- SHA1 fbf98231ced1c5667bb8b83114ca2f83b044698f
- SHA512 b462bd82a58ff51d3351ae5168028439fe3dbfbaeb2465c8b300419fb5d9115eb2091aa6fe4e11cf30ba9ee37e3ef175211e5053d6fc7a3398deace787180f4e
- TLSH
  T138C0C01780802C0F40091B9830C7FCC29EA97C432C831D00C00EB8305F735C4A0C807D
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32