neshta | 875e48f388cf2ac8d4a022e35677c187d5d6f7b57db690724d4ce262556647a9

Sharing

Copy URL Twitter E-mail

General

Target
njRAT%20v0.9d.rar
Size 4.5MB
Sample260916-jesf4avthy
SHA256 875e48f388cf2ac8d4a022e35677c187d5d6f7b57db690724d4ce262556647a9
MD5 de093c0df97310632b011a62c6e781f7
SHA1 e78f34ea87f4bb124fe57432861879506d6ecf41
SHA512 241ceb193fc704f393f0b5f8a896babb0969fe5b3bb345abc41ab72d62685febd75d99f92be4ee526d7a70fd5ea469ab8183f2f6e55962a3b70dd8de610e9474
SSDEEP 98304:xl9lv1MAdPJ4N1ZNNLcLf25EJuZeMY/4N1dfwSmIRlh3PYEihP4y5VSViBO:z9ltMLNzPkf2aJGeGNPf5mIRrPuhP14
TLSH
T1372633FD6652A482E160E664D3B4BEA82D8E80B27532E3FD0BBC5E40ED11771CDA5CC5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

aymentn.ddns.net:1177

Mutex

4cef650e02c2f64aed70aaa9830d5dcc

Attributes

reg_key
4cef650e02c2f64aed70aaa9830d5dcc
splitter
|'|'|

Targets

- Target
  njRAT v0.9d/DevComponents..dll
- Size 4.9MB
- SHA256 2e16f7eb5e8aa4ef66a1c0cc5e4b72290c3182d6f3d0a71f32d13fd2db732ef5
- MD5 c554d8572ce8619ec94597fcbfef09d7
- SHA1 b2e2fbfbe4e3747d824f5d6cabb5607275559929
- SHA512 73c08723319ebddc2023ea1436c27583894834f6667640de09c967cf149e7d564486ede7d256abad4987e6b4a30b994383095a2c969069a71be481531790a85b
- SSDEEP 49152:jfbOajjkPV5M6BEng14kVsAtLMu5fnChs/V7aqONj9o0eXDRNnxfJtqUrSPNk/0R:GajjQ5M6Bcg1uAt3/VuqON
- TLSH
  T1B1367D22B7FC8D3FE06E477A8129465443F8CA56F392FBE6168571B43D627108D1B2A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1 behavioral2
- Target
  njRAT v0.9d/DevComponents.DotNetBar2.dll
- Size 4.9MB
- SHA256 fac9e23262e1ce98746c47da786720a4137c3cd0857ddd96cdc78a218137efb5
- MD5 fa4aaf6ecb9d9a8163af9e0392c35e93
- SHA1 d1b73cefec8658fa3dfa036b18352f7fc0abc446
- SHA512 a3727df00ab016ce74a487258401ed1bbef17b1c6dc4cfa9eb724e94720b547e8c4cec1d908b3e78b78ed6500f87f38c045bff527c9d23fb68db1c96c9f23822
- SSDEEP 49152:TfbOajjkPV5M6BEng14kVsAtLMu5fnChs/V7aqONj9o0eXDRNnxfJtqUrSPNk/0R:WajjQ5M6Bcg1uAt3/VuqON
- TLSH
  T1F2367D22B7FC8D3FE06E477A8129465443F8CA56F392FBE6168571B43D627108D1B2A3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  njRAT v0.9d/Mono.Cecil.dll
- Size 305KB
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH
  T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  njRAT v0.9d/Notificação.dll
- Size 28KB
- SHA256 e490580642f1fb434fa82cff519a67e2c946ab6b1a996b7548090efa880d1a2f
- MD5 d829e5b1c0b11de40392ca48119579f1
- SHA1 cbebbfb4550ee58220bc9e1bececcc6ac26d7667
- SHA512 0fbbc283ab455c71c67fca0d08036c7b75829182245f1e25cc786f2d7e8195751a4eb5f6985cd604a17ea3753ac9126c9b09c7965a14e4e358033bae0cbb35cf
- SSDEEP 384:QEB8TCduPEuokwNwAmkTDB+7HKNUaycIRByyanHCFUOFPwzPwLPwpPwJPwqnPwgz:ReYB++NUnBB36HVOhq4D7
- TLSH
  T1C8D23A29373D873BC9BECF79D00211454BBAE6467903EBA88F9050CA65D73A885032DB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7 behavioral8
- Target
  njRAT v0.9d/Plugin/cam.dll
- Size 63KB
- SHA256 9f94d566ecaf812505291760e4ad5d3956a8845971d4798153f82ffe3f0a373a
- MD5 f95e8c8cb28fc6d730af31b0593ff41c
- SHA1 f28f043ce5af4c444c8002aa3ce26267c4e5add3
- SHA512 0fd29f140e2e880055a17815904eaf502fb66b4f4a11a1a9ab1f1eb47d39181ee3e7d78448f9ffe58e5fdd8b7c8def6cba19fe100a13d294d0b11b347918eac4
- SSDEEP 768:r5Svr1ThGIYTiuPbw4mOz9x3OSYNr+sL0twd9oZ7LmMxx8wW2epiN+K6seBL8Pov:ErC6OzLOSsr+o0eW7LhxxxbepigBoPG
- TLSH
  T122532A2A6B949407C25D2A7C90B70F1407F1C71A6733E78A5B78A2BDDE723908A133D7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  njRAT v0.9d/Plugin/ch.dll
- Size 13KB
- SHA256 16549494133c023f4084320b7c6cf485f66cae3e657bc2458c6ce63ec0fff70e
- MD5 88b5d9811616ec3b9f16cc0f81b18acd
- SHA1 fd48634c357386d780655114f2ca10f7b42d688a
- SHA512 3786134e5dd17e2f312bd7a93c482d2f2c19ee6105b9bd4c914d22f2be08311dc858eb543ce36e0dab1b0e0c4201cca7e0abecc4bca8a6eca7aa93f983dbc242
- SSDEEP 192:3tS88rZZwYo8A6X1ybv4GHnR2e+KChMMwYIXU4MPFO:dS88NBo8+9f+xhMMwYIXU
- TLSH
  T1BF52922677A44F37CEAC53B885A2964217F2C5159322EB9F7CDDA8ED58E234167003CA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  njRAT v0.9d/Plugin/fm.dll
- Size 13KB
- SHA256 c93791e638ba7a2e314de72934eae0b711391b6182e42d0d1609b8ae76f9aecb
- MD5 da34b5a74f4fa7f193a4fc0236461a77
- SHA1 d061cccd045408d0f37731bc9bd80f52ccd33010
- SHA512 78f4755a72490c42febec1a2bd96e043002136455473356fa3835538de442318e7b784c3d304b493cd2429b22e476e5c785427956fdfd3ee60c58061c2d55da2
- SSDEEP 192:+vO5ceRrQHyW2GO3HHWhUreYnWnlBkOiYgl:+vO5piHyW2G2H2+reYnWnlBkfYg
- TLSH
  T12A52822C9A948D03D5AD13B981AE47416FF389160916E67F8CCD5CFB0AA63C46B08BD7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  njRAT v0.9d/Plugin/pw.dll
- Size 37KB
- SHA256 efa05a4bb42843236ba64393be0cb5ff073baa9c71b308cfb052b2e317ac8715
- MD5 4ee1a499e903cd0cb561682b4eb68a91
- SHA1 a35866ff36a7ec0a226b8f814f3642185742020e
- SHA512 00def300ecd4c4e257bc1e7c67f6b9851853f54fc51c1da734f5927a140f4405baa10f7a6fa333013aa7cc8683cbaf14bf290d78618041955590710803c7e7f7
- SSDEEP 768:mNdzkF9F2SbQiRbb34cEyiJ3nfSgT2VY:mNdgF9k4R/34cxkag0Y
- TLSH
  T18F036C0A77C5D242EABDCA745CB2C9142370C04B6D63E78E5CD845A52B72BD11118FEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  njRAT v0.9d/Plugin/sc2.dll
- Size 10KB
- SHA256 3bd3e39e23fbc1c4f544911f5a5071ca0d77837cc101f8a80f6dabb740ce9121
- MD5 fc2edece5e0350eedc88eb889eec3de8
- SHA1 9ba24a132fb7fb86a25827c126224591fcf5f776
- SHA512 f6e3d3fb5571109acade35857f555c34c3a8bc836e059cd4262575f10718b72e73c278dcc525bb5e50333331cd7a96c115bfd7b05e3ebdf76c25d632690ed829
- SSDEEP 192:B5hbf96wNDFlmbZTA6anEaaPs6v/43nJMqfOdiW:zPhOZaEaaPtv/43JRj
- TLSH
  T18622F91BBB888B17E92C57FD09A383631372C1269343EB6F0CC578F959E6785125439A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17 behavioral18
- Target
  njRAT v0.9d/Stub/Stub ..exe
- Size 102KB
- SHA256 e5e22e5bc3a90064b7ee98a99c35437b597ddfd1a34fa6f66125e1bd19677fe5
- MD5 68f9516000a14ed114b7f10266cfcd28
- SHA1 56cd231c18853cdb7f0d7cd77fadd3e5aa65e179
- SHA512 90d4868e5725afec24c0ad98df4975f41f550fd3c9fda756da2f8ed587ff5f6393336f284dbb3f2ce999769e45e4ec6b7156b65151121ffe362368de561c53da
- SSDEEP 1536:14pZNSbq1i+1omVZQ4v+pNvkj8lv8D0H2H3FawIpUmYU:14pZZiBsZv+pVyD0WH3sBpHYU
- TLSH
  T1DDA32989ABE80C25F1BF17BF167065220775B8871E13D7AE2AD4A05D3B333818E65763
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  njRAT v0.9d/Stub/Stub.exe
- Size 23KB
- SHA256 08df80741923f7cb957792f483fbc1ccde261f1d93d0571189c8d5ef10891999
- MD5 fcccde1874042785d867573968bb1353
- SHA1 8bd160c8f5a5f92a210939dd84e8ad6fc0600601
- SHA512 c9ae8df0589908594ca8fcc277fccbbde287bddc190d4cf662bbe768b839410288f233c7327fe32cb9d3622a058b5642b32e4b5ef840fb081915a93da2a6977b
- SSDEEP 384:xweXCQIreJig/8Z7SS1fEBpng6tgL2IBPZVmRvR6JZlbw8hqIusZzZsz:mLq411eRpcnuZ
- TLSH
  T1D0B21A4E3FA98856C5AC17748AB5965003B4D1870423EE2FCCC550CBAFB3ADA5D4CAF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

hacked defense_evasion discovery njrat persistence privilege_escalation trojan
- Family: njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral21 behavioral22
- Target
  njRAT v0.9d/TempPE/My Project.Resources.Designer.vb.dll
- Size 14KB
- SHA256 dffb477770f24a2133e8f59fdbcbe0ff48eff93aa43cbe562b5d53f135d10ed4
- MD5 e8afe7f406efeb154eca5be0b8f0f5c1
- SHA1 20a2060512c659e3b5c6bf4ee4a330bc18571241
- SHA512 410270f31ded0f0a495a0a32649c96f8d41c7bf90ea0195c1312e6e628a98db95c95fdeec802868e45fa4a627e8e242e87805bbcd3ed135fee0d7a23ffb910b8
- SSDEEP 192:d7MuEnwFkBo1VgkgBBbmFJ15nAjV3E0uZVlnlYJL/erOvIiacLTPo/fbgj1MqV4c:d4Wg/BbmDnL/IqSv3acLTPYgLVoRG7
- TLSH
  T10162B61A23F0411ADB3D4B71AAB60BB50373E3498D23FB7A699052B909B3145DAD3B52
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  njRAT v0.9d/WinMM.Net.dll
- Size 43KB
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH
  T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25 behavioral26
- Target
  njRAT v0.9d/njRAT v0.9d.exe
- Size 23KB
- SHA256 08df80741923f7cb957792f483fbc1ccde261f1d93d0571189c8d5ef10891999
- MD5 fcccde1874042785d867573968bb1353
- SHA1 8bd160c8f5a5f92a210939dd84e8ad6fc0600601
- SHA512 c9ae8df0589908594ca8fcc277fccbbde287bddc190d4cf662bbe768b839410288f233c7327fe32cb9d3622a058b5642b32e4b5ef840fb081915a93da2a6977b
- SSDEEP 384:xweXCQIreJig/8Z7SS1fEBpng6tgL2IBPZVmRvR6JZlbw8hqIusZzZsz:mLq411eRpcnuZ
- TLSH
  T1D0B21A4E3FA98856C5AC17748AB5965003B4D1870423EE2FCCC550CBAFB3ADA5D4CAF9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

hacked defense_evasion discovery njrat persistence privilege_escalation trojan
- Family: njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral27 behavioral28
- Target
  njRAT v0.9d/njRAT.exe
- Size 4.0MB
- SHA256 d2c75b1bb64ec350e6ea48f2aea6912c86137d1789954418a1acab593d78f88a
- MD5 2daca1f2e4829f4019c8e71d7afa653c
- SHA1 2f4c50edb53ad8d05589115c9ff21a8701c47184
- SHA512 afa50d0f80d4b64b650a7a177e4ac3a46d2e2f03489e1504ab5816f99ba8cb81c30c12e0f4115ce37de57f282d8e9c4613c49d10c874d4728ecced987c643772
- SSDEEP 49152:3eMXktlHZ0RIglO1CuL9VNcaCdGgSnXYmRLF5zmMhOOkPCeSKjRrnv/rFJ:OJb56MpCaI1hS6Z
- TLSH
  T1C716171336906D28F03927F28949CB7043696F295624967D35F26F4BF9E7AC2BE113C2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery neshta persistence spyware
- Detect Neshta payload
- Family: Neshta
  Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
  persistence spyware neshta
behavioral29 behavioral30