db277f8fbda6e0e1c2a20c20643c3590abfdb180aaf668bbc98ae885f3583795

Sharing

Copy URL Twitter E-mail

General

Target
NjRat-0.7D-Green-Edition-by-im523-master.zip
Size 2.2MB
Sample260823-tp4bfshp3v
SHA256 db277f8fbda6e0e1c2a20c20643c3590abfdb180aaf668bbc98ae885f3583795
MD5 50f2f742a4dd011360c66fc4999ff4ac
SHA1 fb37080d9a2bd2f9aa21f34a507422813eccd756
SHA512 f67338f4bc6df7834fdcaf9aec461c2fa1480481cce3d2c0fc816952b5d1390cd3c8135c5aa19c5dbefd3ea0c8dba2dca5dd4cf064bf29f68ab0976fc5dd5248
SSDEEP 49152:OfA8H8p/74w8rYcU/6r5HQz37liqSgoYDNfXQAfdUAyJGxnAMND:r8cp/7kUir+z37ldZzDNfXQWdUQ1ND
TLSH
T178B5333A03041CBFFAAF94BDEB83C6AE5B3851C50E528DA239C918643A1F5576D5680F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

Malware Config

Targets

- Target
  NjRat-0.7D-Green-Edition-by-im523-master.zip
- Size 2.2MB
- SHA256 db277f8fbda6e0e1c2a20c20643c3590abfdb180aaf668bbc98ae885f3583795
- MD5 50f2f742a4dd011360c66fc4999ff4ac
- SHA1 fb37080d9a2bd2f9aa21f34a507422813eccd756
- SHA512 f67338f4bc6df7834fdcaf9aec461c2fa1480481cce3d2c0fc816952b5d1390cd3c8135c5aa19c5dbefd3ea0c8dba2dca5dd4cf064bf29f68ab0976fc5dd5248
- SSDEEP 49152:OfA8H8p/74w8rYcU/6r5HQz37liqSgoYDNfXQAfdUAyJGxnAMND:r8cp/7kUir+z37ldZzDNfXQWdUQ1ND
- TLSH
  T178B5333A03041CBFFAAF94BDEB83C6AE5B3851C50E528DA239C918643A1F5576D5680F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  NjRat-0.7D-Green-Edition-by-im523-master/.gitignore
- Size 51B
- SHA256 fdc17fd35182ca77a4888c8682f48ba5b57463ca5865b96eb8a652ba15c63664
- MD5 f4d61f06ff1f26f8a4bfd8ce606936cf
- SHA1 c8aa0daaf98a546fa21722cc1bae8f17afc3e783
- SHA512 e661966117f6ae71f512aa4e4e62595399f3c7e50cccd3ae43fa6eff9f3403280c64d90c50c01983adfcbfe04cbc25a3239a0a6bfc4ece8d04002d7f5b5be5ec
- TLSH
  T1B590026C8601908011D64A9145D42404B99657D91141980D2D85649050AE6E34349331
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  NjRat-0.7D-Green-Edition-by-im523-master/LICENSE
- Size 1KB
- SHA256 6b0382b16279f26ff69014300541967a356a666eb0b91b422f6862f6b7dad17e
- MD5 d88e9e08385d2a17052dac348bde4bc1
- SHA1 6d842099530d126dea37db858a755e444f4de3f7
- SHA512 f23a3f3ec79340594ea40d731087e8586326a96c6cb9675c7a58687255885148286aa73cee087a5a3c976ea901fde16e229d00e98c65188cce3f0d75c8390a10
- TLSH
  T14521B45B738017706A8227B23880B4CDF34BD49EBC3B16842416B358031F8BCE1BFA29
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral5 behavioral6
- Target
  NjRat-0.7D-Green-Edition-by-im523-master/NjRat 0.7D Green Edition by im523/NjRat 0.7D Green Edition by im523/GeoIP.dat
- Size 1.2MB
- SHA256 8a0675001b5bc63d8389fc7ed80b4a7b0f9538c744350f00162533519e106426
- MD5 797b96cc417d0cde72e5c25d0898e95e
- SHA1 8c63d0cc8a3a09c1fe50c856b8e5170a63d62f13
- SHA512 9bb0c40c83551000577f8cf0b8a7c344bc105328a2c564df70fabec978ad267fa42e248c11fb78166855b0816d2ef3ec2c12fe52f8cc0b83e366e46301340882
- SSDEEP 24576:X49Ncvb7y4+FFfI12ky0dBRQ3fNLxDKefhoFbQfAACiTQVapg:o9Nhw1vJ83fNLxu2UVa2
- TLSH
  T106555A16FF8599DB08523D2EF81A8D9C08699D35FC0A0336316E7B5D90747A8EDE60E3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral7 behavioral8
- Target
  NjRat-0.7D-Green-Edition-by-im523-master/NjRat 0.7D Green Edition by im523/NjRat 0.7D Green Edition by im523/NjRat 0.7D Green Edition by im523.exe
- Size 1.6MB
- SHA256 f0c85722b88d1e7a1941ba17551cd5c29aef99fad86d78a5631a0f5446b3f580
- MD5 1033c448810d3b507423546432e2f502
- SHA1 2bf9d04f68ed15b957378fb95daa78c85d5b2b26
- SHA512 aeb964632dfad41fc383a68ace0e6beb152a7075f21a32e449624a27da5d2a5ccda0665fbd90597d65d74b0790877baf6f81336660b1df4bf38b41cd0bc6cd44
- SSDEEP 12288:ouicuiPszLSDeMFFFFFFFNPjiRfbljmYpNk1Yt6JwpwqVcTeec7neIjjpL:ouicui0zLSDRPjiRfzUcpcNgD
- TLSH
  T176850B03B343EA54E97812F46105CFA052696E4E9178C1F639AC3B79FBDA8D1BD853C1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10 behavioral9
- Target
  NjRat-0.7D-Green-Edition-by-im523-master/NjRat 0.7D Green Edition by im523/NjRat 0.7D Green Edition by im523/Plugin/cam.dll
- Size 63KB
- SHA256 7a4977b024d048b71bcc8f1cc65fb06e4353821323f852dc6740b79b9ab75c98
- MD5 a73edb60b80a2dfa86735d821bea7b19
- SHA1 f39a54d7bc25425578a2b800033e4508714a73ed
- SHA512 283e9206d0b56c1f8b0741375ccd0a184410cf89f5f42dfe91e7438c5fd0ac7fa4afbb84b8b7ea448b3093397552fd3731b9be74c67b846d946da486dcf0df68
- SSDEEP 1536:7EoML5LFXbUu5ExN3hep+cx4sKcuxpSe:7ERZxQxep+cx5Kcu3
- TLSH
  T15153286E6B98A11AC18D52BC50B74F4007F1D64AA323EB4A6B7851FCDD733808B5379B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral11 behavioral12
- Target
  NjRat-0.7D-Green-Edition-by-im523-master/NjRat 0.7D Green Edition by im523/NjRat 0.7D Green Edition by im523/Plugin/ch.dll
- Size 24KB
- SHA256 7722206dba0cfb290f33093f9430cb770a160947001715ae11e6dbbfaef1c0ee
- MD5 73c8a5cd64fcf87186a6a9ac870df509
- SHA1 7ea0bd1f15d7c8bc8b259b3a409b2cd3b0fe3eec
- SHA512 b5faaf370d951bccd34da369e970d75c8f038bbfc99cf042c89a4ceb9cc077c1c8fc81318d79180c67373cca8024d27aaba052d4cee82a3aeda8d59ad0ac817d
- SSDEEP 384:nok/7+I98wxOatKr3xcNRPKtoMlqfpibcWY2EvHqNiaR6D3sO9:c6oh4RiHlqhi/EvDou
- TLSH
  T197B2181563D2CB63CEBD077A0952A24167F2CD44DB12EB6F3ED874ED19B37049B0268A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13 behavioral14
- Target
  NjRat-0.7D-Green-Edition-by-im523-master/NjRat 0.7D Green Edition by im523/NjRat 0.7D Green Edition by im523/Plugin/mic.dll
- Size 50KB
- SHA256 b6fb6b66821e70a27a4750b0cd0393e4ee2603a47feac48d6a3d66d1c1cb56d5
- MD5 d4c5ddc00f27162fc0947830e0e762b7
- SHA1 7769be616d752e95d80e167f2ef4cc6b8c3c21fe
- SHA512 9555f800213f2f4a857b4558aa4d030edf41485b8366812d5a6b9adcc77fc21584e30d2dd9ce515846f3a809c85038958cb8174bf362cf6fed97ca99a826e379
- SSDEEP 1536:YmXfC5RemUFTxqPbSiQZrCF1HzGL17d8:YmXfCgFTxq+iQZrGTGL17d8
- TLSH
  T10033B4547A981DBAC11F123DACDB1261F6B18D64B223F37B1CE960F358833DA96416F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  NjRat-0.7D-Green-Edition-by-im523-master/NjRat 0.7D Green Edition by im523/NjRat 0.7D Green Edition by im523/Plugin/plg.dll
- Size 28KB
- SHA256 ea9ecf8723788feef6492bf938cdfab1266a1558dffe75e1f78a998320f96e39
- MD5 0cbc2d9703feead9783439e551c2b673
- SHA1 4f8f4addd6f9e60598a7f4a191a89a52201394a8
- SHA512 06f55b542000e23f5eeba45ea5ff9ffaddddd102935e039e4496af5e5083f257129dab2f346eeae4ee864f54db57d3c73cf6ed1d3568087411203769cf0ddd66
- SSDEEP 384:iLa+IgaVdBJfFfZsDNujglHdUky5P6bL2XIadYweVqJE+La7gmlweR9Oq7Bp2RhG:8ZIgYdbfAhdGJ6bL6YT2fO9vca2kSs
- TLSH
  T185D2C70D27A0C525C7BE87365E2143225EF786134C25FF2E4CCB4AED5EA2789DB4864B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18
- Target
  NjRat-0.7D-Green-Edition-by-im523-master/NjRat 0.7D Green Edition by im523/NjRat 0.7D Green Edition by im523/Plugin/pw.dll
- Size 251KB
- SHA256 3a1cc072effd8c38406a6fddf4d8f49c5366bb0e32071311d90db669940987ce
- MD5 872401528fc94c90f3de6658e776cc36
- SHA1 c58e22158774d16831350de79eb4e1711379e8a6
- SHA512 6da881fb968ba9d9200777a9f19d69220468482f3eaaf687c433790d512da520f5adb23441fdc8f3fd10785918eb2864ea3ef32ddb80d2f6665550ea455f4a2f
- SSDEEP 6144:/e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMO1:WxJ/JmSG9T8CEgdM
- TLSH
  T16C44E02722CE3CA1E17E4A7033B353C2C3A9DD108612D51E29D83556AA7E1D37A42FD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral19 behavioral20
- Target
  NjRat-0.7D-Green-Edition-by-im523-master/NjRat 0.7D Green Edition by im523/NjRat 0.7D Green Edition by im523/Plugin/sc2.dll
- Size 12KB
- SHA256 3e5141c75b7746c0eb2b332082a165deacb943cef26bd84668e6b79b47bdfd93
- MD5 19967e886edcd2f22f8d4a58c8ea3773
- SHA1 bf6e0e908eaad659fdd32572e9d73c5476ca26ec
- SHA512 d471df3f0d69909e8ef9f947da62c77c3ff1eb97ac1dd53a74ad09fb4d74ec26c3c22facc18ec04f26df3b85b0c70863119f5baa090b110ab25383fcdb4e9d6e
- SSDEEP 192:3SDU/WQw9hM/BIlbzMmY3CX80B2/mZLks4LX08Lt6dD5DHqKlZTFzfpni48nafL8:3SDOOMJIpIm8/IQs4z08IdD5DvZTFTpM
- TLSH
  T10342080DBF48C217EA5C0B79167317519373C0560303EFABAECEA4F669AA3C516183C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21 behavioral22
- Target
  NjRat-0.7D-Green-Edition-by-im523-master/NjRat 0.7D Green Edition by im523/NjRat 0.7D Green Edition by im523/Sound/Sound.wav
- Size 643KB
- SHA256 5ff592b183b2c990448f1dcd842a29cfe17a3eaa9956e0135c945c578676344a
- MD5 562fb3b4b1b1eafd2cf107f2e92e0670
- SHA1 cebf2a65c99e1b2c13d7212bf111bdf0fe5c13ce
- SHA512 807cd580a04c84fb671c1dfa0fc2b90bbf2428e4727d7fa3956011623cae5c7e093acf55d5f0ad325116b729c96e845f06f3fc3007e8048238aacdea7f21386a
- SSDEEP 12288:kqqW6lExbQPGUXw7zYmDahneArkGZKatb4TZdXEuH3S28UI:Mz65YQa44kKmLVHiXUI
- TLSH
  T1FCE40262D880CD19FACBCB7756D3991855E1A808E2AA570F75C59ECBE9C3344BC4D383
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

discovery
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral23 behavioral24
- Target
  NjRat-0.7D-Green-Edition-by-im523-master/NjRat 0.7D Green Edition by im523/NjRat 0.7D Green Edition by im523/Stub.il
- Size 399KB
- SHA256 ed79411707d5a9925f1146e595983804e4eeafe35e72eb51703908eff13cc073
- MD5 3575abf7ab346ec4039138fad1fab4b7
- SHA1 c5c7b08cfcb707cab339d966e36de6c3c97bd7f5
- SHA512 2044d78e20a4d7b8acbc0ebf61c38176314ccf02a0b009b161530b78658444faed8304a628938514d98effe5ebdd81275e1328f65d98ec3f2e545f9c9de56179
- SSDEEP 12288:YbidABkcrO7qU+1gtxPXEx8V0IC0FcUYpm+0DGG+ld+HkZCpC654tDarkic:s
- TLSH
  T14594FE298228559ED572661DBE72C756F76F42230F326C96BCAFC254BF312C8813463B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral25 behavioral26
- Target
  NjRat-0.7D-Green-Edition-by-im523-master/NjRat 0.7D Green Edition by im523/NjRat 0.7D Green Edition by im523/Stub.manifest
- Size 487B
- SHA256 835a00d6e7c43db49ae7b3fa12559f23c2920b7530f4d3f960fd285b42b1efb5
- MD5 4d18ac38a92d15a64e2b80447b025b7e
- SHA1 5c34374c2dd5afa92e0489f1d6f86dde616aca6c
- SHA512 72be79acd72366b495e0f625a50c9bdf01047bcf5f9ee1e3bdba10dab7bd721b0126f429a91d8c80c2434e8bc751defdf4c05bdc09d26a871df1bb2e22e923bf
- TLSH
  T16EF0DCC1D188CA6AD73042A13A66E410A2AD435B19DD49EC74DC2ABB6F0BAC680C30F1
- MD5 SHA1 SHA512 TLSH
Score

3^/10

adware discovery spyware
behavioral27 behavioral28
- Target
  NjRat-0.7D-Green-Edition-by-im523-master/NjRat 0.7D Green Edition by im523/NjRat 0.7D Green Edition by im523/WinMM.Net.dll
- Size 43KB
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH
  T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  NjRat-0.7D-Green-Edition-by-im523-master/NjRat 0.7D Green Edition by im523/NjRat 0.7D Green Edition.lnk
- Size 1KB
- SHA256 77f0c1ce1a36358b3372d43c84102b426604a7b30dfc4ff055757ff4e803775b
- MD5 d42f98173f80e3c8c53ed57c2f559e2c
- SHA1 1820360c266fcc912b3ff6ad9354224e36ec5f39
- SHA512 ff47fd5c495378f8bf171907db7f00cc8cf862ca87e351cca534d3ae82efd3364e7d98e5e285be90f00689efd2822284cf2d7647e3cd1d0fff093f4e10fab231
- TLSH
  T1AE416E7203EAD5ACD6F6C3328AF256C9C1B1FDD45A7AD90E61C5918D0D6190462D0F3F
- MD5 SHA1 SHA512 TLSH
Score

3^/10

execution
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Targets

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Boot or Logon Autostart Execution: Active Setup

Enumerates connected drives

Drops desktop.ini file(s)

Enumerates connected drives

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32