njrat | 4b6c96fcc41c6daeafa2db52a7f8e388d507a3bcb9b09a44332fa0a0725460b8

Sharing

Copy URL Twitter E-mail

General

Target
nepc.rar
Size 301KB
Sample260916-m171fstv3n
SHA256 4b6c96fcc41c6daeafa2db52a7f8e388d507a3bcb9b09a44332fa0a0725460b8
MD5 2cc2497ce17ba05e7ec1f5b24d9139f4
SHA1 38a5a63508747dc3aee05f310da39e772f7f89d8
SHA512 5d639d15c91e6747a285a201dd4e67b08ab564f4227d682f7fb3e9a3ea2f1d55399b052b24975183cdc94ac0fee98747b4a0278ed7de4c1bd568ef847878eb3a
SSDEEP 6144:+V3Ya3s4c2YaBiRazJNf4Fi0qGOdcNh6HKI5WWDAX7LXzbPvl2t:MIEI2jsazn49P4HHKIMLjgt
TLSH
T1E1642376BA4C44BDA2817BA1CCD26994450D15DE972FA9E6BD48604C2ACFFECC0C6E41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  nepc.rar
- Size 301KB
- SHA256 4b6c96fcc41c6daeafa2db52a7f8e388d507a3bcb9b09a44332fa0a0725460b8
- MD5 2cc2497ce17ba05e7ec1f5b24d9139f4
- SHA1 38a5a63508747dc3aee05f310da39e772f7f89d8
- SHA512 5d639d15c91e6747a285a201dd4e67b08ab564f4227d682f7fb3e9a3ea2f1d55399b052b24975183cdc94ac0fee98747b4a0278ed7de4c1bd568ef847878eb3a
- SSDEEP 6144:+V3Ya3s4c2YaBiRazJNf4Fi0qGOdcNh6HKI5WWDAX7LXzbPvl2t:MIEI2jsazn49P4HHKIMLjgt
- TLSH
  T1E1642376BA4C44BDA2817BA1CCD26994450D15DE972FA9E6BD48604C2ACFFECC0C6E41
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution njrat persistence privilege_escalation trojan
- Family: njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies Windows Firewall
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2
- Target
  nepc/nepc/README.txt
- Size 363B
- SHA256 948c9899de73f872b01f3fc8e384496506596ea25cd6748055f6b24e77dd9d1c
- MD5 8cbccda0b9aa234c12ab1b18c0d4ef90
- SHA1 771b6d7846b56e8b9e0e72b98e35f8628d392d5d
- SHA512 2ee679246837b88e056fcac56d3ba7b6ede58a0617a17e3b076007cc5019914a40805aa45bf903543691061d1a02925f1ffe0096063646028a2401422b407aef
- TLSH
  T14EE0C04EC9B1E67C5E393233B71501D2C546C0DC570E000DA65CEC167A0DFB0E0E5067
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution ransomware adware persistence spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral3 behavioral4
- Target
  nepc/nepc/ac_bridge.js
- Size 152KB
- SHA256 112d3faf06c878c472b25a0d2cdee885fee80d6c5345a9dd602c2ef70887f788
- MD5 6ccdd9db47b018f0a45fa555ff5e264f
- SHA1 ead20b3a4679da0bdbdc2eed9b0ec1925c75b7b1
- SHA512 345dbc3a0688d9ca3baa32ea51edca7868c2435272dc7f953a911b9458423d73cb467aa92d959317afaa0d3c366d793f01820ba8cb215d57ec40158f12f7d570
- SSDEEP 3072:ZCvCDtQpvzOY0mQrYrFQxAqXAaQdczvQg47SFOokQpg3FwiwgpB0lINK6jx5E3FR:ZGCRQpvzOY0mjqxtVQ2zv147SkoHgWiw
- TLSH
  T1A5E3744929F78262812BF42C2B4BD04CF23995036159DEA47CECC364DF9A931A6F67F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral5 behavioral6
- Target
  nepc/nepc/fb_setting.txt
- Size 3B
- SHA256 d7fa28c3026137549d1a22ea54d81a96a3c684ad9d3c8c1bcec2287e25ac4961
- MD5 4dba4ac2c00a8ba0f1d6eb96706c5bdd
- SHA1 c2948b69c68969f78d3f3297de53a4899f524226
- SHA512 5ff5f34282761a982660cb0f3d9f24dde6126b3e8882e78090b9330707faff60858557f8c05d8931ca8c9fcea3b6d49c78adf76e872e95555796f0e5abff5c4c
- MD5 SHA1 SHA512
Score

3^/10

execution ransomware
behavioral7 behavioral8
- Target
  nepc/nepc/n5.ts
- Size 1.2MB
- SHA256 05fd4f8a3a42f278941547a43cbca8d5a396f926a180916773029e0cbb4f3f80
- MD5 5b20778ce1ffa3291141eb95067e1235
- SHA1 e26df31d39a2ff235fcc36130a6489b86cfe6d62
- SHA512 92bd3b03bce56a7a5c0657ee7e238c5917b12f33736e340249638cc35409c17f3792575365b831bacad069c804bee979ea73afd853b7071fa7bbf9ef8702b573
- SSDEEP 24576:gJuBJu6vk1hE4ouIY/NhxTKve/Kg/J/kFhE4Yu44UYAzZ0Cbe8qUp7xR:gJuBJu6vk1hE4ouIY/NhxTKve/K2/kFY
- TLSH
  T10A55665B152911B9C577F37E8B934048FA33A7237A12C6A57DAC82212FB702452F3F69
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

adware execution persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral10 behavioral9
- Target
  nepc/nepc/nepcmenuv2.exe
- Size 218KB
- SHA256 bee76974ad1cab50a8a8f166d6e3e9c9d641ae6ff811b339641976a5bb6f9d27
- MD5 8a950935ac6a5de88102078e85c6c431
- SHA1 fbe44d24f6de41482785173e4a91bec531d889ad
- SHA512 204c489fcecea9e11f0f0fe189c00753dc04b13ac2d364644f137e0535d2aa5b8f98efc592f9a44bc137ef7c62a663ede9760dd54c8a70889e8e743acecf2dec
- SSDEEP 3072:fL+kuHtJ/BF1G25yC1pefEHBAnpK37nXNV8u0BEQ7Ehy74tyJhTtKvsciyW4c4vj:CkS/BzG25yCqq8T6hocDDsazSJg
- TLSH
  T1F9243A5227E8C92BDB7E17BAE4B106206774E54B9122E74FB4CC19F95B5338049233AF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion execution njrat persistence privilege_escalation trojan adware ransomware spyware
- Family: njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Command and Scripting Interpreter: PowerShell
  Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
  execution
- Modifies Windows Firewall
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral11 behavioral12
- Target
  nepc/nepc/rp_setting.txt
- Size 3B
- SHA256 d7fa28c3026137549d1a22ea54d81a96a3c684ad9d3c8c1bcec2287e25ac4961
- MD5 4dba4ac2c00a8ba0f1d6eb96706c5bdd
- SHA1 c2948b69c68969f78d3f3297de53a4899f524226
- SHA512 5ff5f34282761a982660cb0f3d9f24dde6126b3e8882e78090b9330707faff60858557f8c05d8931ca8c9fcea3b6d49c78adf76e872e95555796f0e5abff5c4c
- MD5 SHA1 SHA512
Score

3^/10

execution ransomware
behavioral13 behavioral14
- Target
  nepc/nepc/symbols.ts
- Size 19KB
- SHA256 2fa67a8f4800c9b9f3afff9d11beb2cbb5cf50b7d2a521c2e56318591bac2776
- MD5 1838fc01f65b0614602f72036a6ec8db
- SHA1 9fc98ba9f5dd6b303d38210f2c8e2c80a7a135d6
- SHA512 d356f321940df5eb23101dff0d716d0d99ab14f016353727220959349e5554ef38105b4f10544f006d2f9a975aa3cb31374618a4d66b62a06d32cae591269109
- SSDEEP 384:dn0nTzJ88zYja9Lmmc91rAsFR0PDCaf082h43B+lL29M:F0XnzT9oQ082h43B+Yy
- TLSH
  T1409244923364AFEBE56D0485D9F886EF24F00DA14318FFB0E56DD5FE80A0858E5D2AD1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

8^/10

discovery adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Drops desktop.ini file(s)
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral15 behavioral16
- Target
  nepc/nepc/tsconfig.json
- Size 233B
- SHA256 95ff4431b600b63e0fd6ebfb43826ed79adfb72e631db827b889102fd998c438
- MD5 94a4d7c67df3cebd3c6c54206ec8da62
- SHA1 1b4e3bde1f17ac1fb38b7908319f4311635a23f6
- SHA512 c9e304bed7c06c734eae03adc704f71e8b9bc50316dd6614ca1044370962e3850a390df1c3f333ee8561624d3f72551cf54853cb8c0e81b4914715f3321987c4
- TLSH
  T1A1D05E21C4240EA201D909589C4C9203596091830A443C15B68A120D5B1C63F5AB66E8
- MD5 SHA1 SHA512 TLSH
Score

8^/10

execution adware persistence ransomware spyware
- Boot or Logon Autostart Execution: Active Setup
  Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
  persistence
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral17 behavioral18