Extracted

• • Target
    njRAT v0.7d Golden Edition - Rus.rar
  • Size 13.0MB
  • SHA256 0b8d3faf0da067528aab09debc043328231543d654d470540d321b9da7d1d650
  • MD5 4e4140cd8e2d6218ad20d8c86084a820
  • SHA1 9afa265b3f84f5dbaba371bdb31a920055274cdd
  • SHA512 ae91f968037f214e5bff80a7ffdb73388fec4fc39e2b9a603a675edfd3b67ae6d9d9569006eba547ca4172032360818dab5155f543d5f4a19c1dfe6c9884b970
  • SSDEEP 393216:1jZo0FURV9+uuM7LvWnrf//z6Mkcxzl7LU6NHu:1fef9+6Lmf/37DHu
  • TLSH
    T180D633AB378AE81F45BEF730C79EB36F74BD81CE8A017AA3840B015A5DF4A94555009F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2behavioral3behavioral4
• • Target
    njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/NjRat 0.7D Golden Edition - Rus-JIT.exe
  • Size 4.1MB
  • SHA256 88e5040a5ed638e7a6d17854065e5e162e98e39e541f316b98a1096b0efccff4
  • MD5 66328d73f8ea17c76435bb7777ba4331
  • SHA1 3d61c72eae0e4b9e877e449955b79597fee6d9d1
  • SHA512 b34647af856e96b2949edfd85bf1dceeed408891b3665cd3b2615138c30302a3218bf9eb5bc1332be120e19302de7f26bbf4e3a741095e1888fa358a934c3e67
  • SSDEEP 98304:G8t1oCvnJPJHhyigw/MqPXs8O5HZlmx8BBPaRNz2GTclE:VosnJRHhyigw/DjO5nmuJQc2
  • TLSH
    T12F1633582380CE4ACABE74F6D85687F163B95E6D60D5C2112336B922FDF9C13CC9096E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6behavioral7behavioral8
• • Target
    njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/NjRat 0.7D Golden Edition - Rus.exe
  • Size 4.0MB
  • SHA256 ff744c7a1e3490377eb8edff1349f7c2ad4c3e6e0aa460c685cdac8a595c3d71
  • MD5 8b2d60831a4afb4170ae0c0aa9aee78f
  • SHA1 e368e92a5b4896ca180d0af0cff1f6b94e5c98ef
  • SHA512 feb2884d9c0228c116569106e6b47f0873becd4843b204c43be3fc3238ea24418615fa70b0efea368b25a2142f144ab0dfcc20ce4200f38acda2158d3f96d13e
  • SSDEEP 98304:vjO4PEUiYrwM8XKeAGRDLNx2M6sK+ADee2:vjcGw+erx2jH+6e
  • TLSH
    T12816F1606270ED80BAB821F6498A7BD3E2703D453DC0F3178DB37962D8F6A275DD416A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discovery

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral10behavioral11behavioral12behavioral9
• • Target
    njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/NjRat 0.7D Golden Edition.exe
  • Size 4.0MB
  • SHA256 84b88fec72386be90e60197170e04e553d2528dd01c34f79586da05b6a0683ef
  • MD5 e47dd013fde40584fbbc466b353a2227
  • SHA1 d858baab86da480d5de0af81c3f5db2de0b74b45
  • SHA512 f6ee70e699021a496a4e53478dbc37e1b12a4e9bb8538ac4a99b590871696684f1107d6467fd7619ed75a7f63310c83446d1f9f35b38b852b1c4c700779d090f
  • SSDEEP 98304:68t1oCvnJPJHhyigw/MqPXs8O5HZlmx8BBPaRNz2GTclE:ZosnJRHhyigw/DjO5nmuJQc2
  • TLSH
    T1AA16335823C0CD4ACABD75F2C85687F167262E69A5E6C1112336B992FEFCC1BDC8085D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral13behavioral14behavioral15behavioral16
• • Target
    njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/AntiProcess.dll
  • Size 16KB
  • SHA256 f643ab116e7bd8515032a502b8700afb5bdbfc08fc1caa08817b3061e98b763e
  • MD5 b21947a28760750689f46e071d575d07
  • SHA1 6008a9ff367e7a715422d2e2f96312f1a3231a9e
  • SHA512 75fd467e4be5480e7dc4ce665a50cf5fcea3c4301f17674feec866d04e0f7036efaec0feffa35fc07ab19b70ff82d133c457c88d7c776f62160bff6cf13a2399
  • SSDEEP 384:0sRt7Wow+KPUhkRf1jJXMgthizKN8dhct+1W7Lf45kNQfjO8pZ3TR:xRt7Wow+KPUhkRf1jJX4dhVI/mf
  • TLSH
    T1F4720817A3E6873BCFED0EB48526150483F1C3069553FF2F9DC665768AA33404B9279A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  7^/10

  discoverypersistenceprivilege_escalation

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation
  behavioral17behavioral18behavioral19behavioral20