Extracted

• • Target
    NjRat-0.7D-Golden-Edition-main/InjectIcon.dll
  • Size 13KB
  • SHA256 98348ffe70a68f69d934118a2d14b86b382d698601827a4c1d322d878d36bbdc
  • MD5 83921e813f885ae1669aa0efa21f8695
  • SHA1 130f59f513eb64018736c0173d45a2b524c282fc
  • SHA512 f123ef9c5fd3157c6f51b1ac02d6103baa1ebd2a02e3c2d95355b15ce3730f241c0d61d1ffc07713b8d3af7600730d29049683c589c7007a9a4e7bb4707f58c3
  • SSDEEP 192:OLCpu5eYPefzYTZVzunlYJL/eBvnaDNIDLTHqaf0+E+sQAE8UBscU:OL+1qe09prqNnq+LTGQY
  • TLSH
    T1EB52D70693D6C332CE6E873A5C1377A45B31DE00DA52AB3F55A0B2676DB33440E93762
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    NjRat-0.7D-Golden-Edition-main/Mono.Cecil.dll
  • Size 305KB
  • SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
  • MD5 851ec9d84343fbd089520d420348a902
  • SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
  • SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
  • SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
  • TLSH
    T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    NjRat-0.7D-Golden-Edition-main/NjRat 0.7D Golden Edition.exe
  • Size 2.2MB
  • SHA256 dba95547d13d71fb02502678d7a8227eaa4f55ba8b8d1b570b20886d367b96f4
  • MD5 b47debb324cadd1fff8375243ec76f91
  • SHA1 2f24290708c21b010903ccd9ccb13899090457c6
  • SHA512 c5b2a592208be67bf7bce9e6485066ffa74c28b5c73c951263282db27695e7e4ac6aea1364056f592cc0f6abdae54ac85f53983c00be2c587be2aa46d839a4fc
  • SSDEEP 49152:L/o/i03qeOPi11111110NKaAMePOAogZrpoPO7:Lw/b3qXi11111110UPPOzKpi
  • TLSH
    T1A3B53B20D258BC874277B2E8451C046336710C22B97A4F0D87BF755DE5F493FAABA2B9
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionxwormpersistenceransomwarerattrojan

  • Detect Xworm Payload

  • Family: Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral5behavioral6
• • Target
    NjRat-0.7D-Golden-Edition-main/WinMM.Net.dll
  • Size 43KB
  • SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
  • MD5 d4b80052c7b4093e10ce1f40ce74f707
  • SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
  • SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
  • SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
  • TLSH
    T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8