Extracted

• • Target
    njRAT v0.7d Professional Edition By Dark .NET/Mono.Cecil.dll
  • Size 305KB
  • SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
  • MD5 851ec9d84343fbd089520d420348a902
  • SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
  • SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
  • SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
  • TLSH
    T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    njRAT v0.7d Professional Edition By Dark .NET/WinMM.Net.dll
  • Size 43KB
  • SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
  • MD5 d4b80052c7b4093e10ce1f40ce74f707
  • SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
  • SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
  • SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
  • TLSH
    T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    njRAT v0.7d Professional Edition By Dark .NET/njRAT v0.7d Plugin Compiler.exe
  • Size 352KB
  • SHA256 1a6f0316931108a810daf959016373747a6017c62c2b1efb7ee049bad6961b19
  • MD5 8baae827141c6d2fbf516bea3ec32233
  • SHA1 28688944846dba48ab91fe74c721868599270433
  • SHA512 3f54393a0810c1a5bf57ecf9ba99fec48cc6ed974c877bbd24bacffb56f4c53db1af60680cb15ce6a3b6253a3d0a3c7d5349e626d924ceeb84106626ec1bd6c2
  • SSDEEP 6144:Q2aOs7VRzXl5uigI/6dSB4MCsc4RSbq8tcomGlbDoSeEos:6VR/hF/6dSB5CscQSbqMBlbDFis
  • TLSH
    T1A274012275408E69FAF531F3D562AC2412962F369899640F74B77B4BE8F3D43EC2148E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral5behavioral6
• • Target
    njRAT v0.7d Professional Edition By Dark .NET/njRAT v0.7d.exe
  • Size 406KB
  • SHA256 12c8b5d3a0a5fe18a149da3c33b14b2cd0fb548e4ef491e1d242ae4ad7e7b8e4
  • MD5 4d7d74a3cc72e557c5157597c640d275
  • SHA1 5b2b48173bcf9d6d8fc1d98b2c67c6b1b1119732
  • SHA512 92404a311655ea0ea8e726a0538111d0afa2020c5c786f92679914d77043f91f6030dc6dfdf5d27effbf4c3288a58cf7308489f90b57be3e0d75327e7c7b8ac8
  • SSDEEP 6144:I39z4WNnY7qa7F/P+l4FEQMTM4D5+yLG4Ma5RUBkcTk3WKEIok9Fw3rU59tt4ULh:ItUunYGy1BEQMTtT64Mn/A+IBkr09ty
  • TLSH
    T15C940225B4448E6AF8F671F2D491ADA422662F369852981F3573B70DD8F3F03EC2294D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackeddefense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Modifies Windows Firewall

    defense_evasion

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral7behavioral8
• • Target
    njRAT v0.7d Professional Edition By Dark .NET/stub.il
  • Size 228KB
  • SHA256 daa4362a762a472f717a480102883382b41dc5c17484f649272c5bdb5142917c
  • MD5 2041e64bffccfbc9379235fdf294f188
  • SHA1 19c1fd78e8f36493e2a9b1c0e437afc2416586f8
  • SHA512 c5d5be4615767483432287d3486e805d6744d45a5eac6445cef87ce1e8475bcdbb521dcd8d1c7918d8d73d6634617842b67290bc4fb734a4ab31dfe7daaaec13
  • SSDEEP 6144:AdCb38V4N80EC7PAdpJZrLZ9u4zDdyxGu8VnNQUC:AdCb38V4N80EC7PAdzZrLZ9u4zDdyxGG
  • TLSH
    T1DB34EF2D8228999AD4B2701DBA72CB16F76F12270F716C967CEFD254BF322C54270636
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  execution
  behavioral10behavioral9