njrat | f9ac08dc0d9d265ba44e7b256cc554cd9a741ca2a7e4dc01807376a90f8b1024

General

Target
01af93c099eda51a2b46fb2108fc1e2a.exe
Size 2.2MB
Sample260913-vsrbqsar8v
SHA256 f9ac08dc0d9d265ba44e7b256cc554cd9a741ca2a7e4dc01807376a90f8b1024
MD5 01af93c099eda51a2b46fb2108fc1e2a
SHA1 fd7ec45552919baf92c37cb17b533d5eedfe5758
SHA512 9b97303c8804a99166c1918b05c437fc5521e1cfcc0bbf7ed06bcc5c4e7e405b8b24ad593775aaa7fd2c4b21f095d1e1e130b17f63151b8f537ace09b6e78b8d
SSDEEP 49152:V8U0SoUQ3nUMOZkDNgSJ71GXRBOkD0J3QIT3sAHQBetjDmWnp8LpMhH3N:eU0PRnUMOZMWSJ71GXAJ3Z4AHEeNyC9d
TLSH
T16EB533059D0688A5D5D41CF9287A8BDDCB688DD20E2CDD23DC7C3FA5543DC4A2E2B6E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

xworm

Version

5.0

C2

8.tcp.cpolar.top:13488

Mutex

FK4geXl75KmOAjiL

Attributes

install_file
USB.exe

aes.plain

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

C2

8.tcp.cpolar.top:12329

Mutex

1eb30b95d1903dbc454f1d6ece31cfbc

Attributes

reg_key
1eb30b95d1903dbc454f1d6ece31cfbc
splitter
Y262SUCZ4UJJ

Targets

- Target
  01af93c099eda51a2b46fb2108fc1e2a.exe
- Size 2.2MB
- SHA256 f9ac08dc0d9d265ba44e7b256cc554cd9a741ca2a7e4dc01807376a90f8b1024
- MD5 01af93c099eda51a2b46fb2108fc1e2a
- SHA1 fd7ec45552919baf92c37cb17b533d5eedfe5758
- SHA512 9b97303c8804a99166c1918b05c437fc5521e1cfcc0bbf7ed06bcc5c4e7e405b8b24ad593775aaa7fd2c4b21f095d1e1e130b17f63151b8f537ace09b6e78b8d
- SSDEEP 49152:V8U0SoUQ3nUMOZkDNgSJ71GXRBOkD0J3QIT3sAHQBetjDmWnp8LpMhH3N:eU0PRnUMOZMWSJ71GXAJ3Z4AHEeNyC9d
- TLSH
  T16EB533059D0688A5D5D41CF9287A8BDDCB688DD20E2CDD23DC7C3FA5543DC4A2E2B6E2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

victim discovery njrat xworm rat trojan
- Detect Xworm Payload
- Family: Xworm
  Xworm is a remote access trojan written in C#.
  trojan rat xworm
- Family: njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Targets

Detect Xworm Payload

Family: Xworm

Family: njRAT/Bladabindi

Checks computer location settings

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2