njrat | de45a4a02445ee79075e835b94c39f75a10ece2c69a737786018e2c2f1d6bc58

Sharing

Copy URL Twitter E-mail

General

Target
njRAT 0.7d Horror Edition.rar
Size 16.3MB
Sample260925-qsyctstsa1
SHA256 de45a4a02445ee79075e835b94c39f75a10ece2c69a737786018e2c2f1d6bc58
MD5 a1b3ad5f02c8def3ec020c4ade1d2f8d
SHA1 1b8cb0d31a3405aed0d28523dad874805c62768e
SHA512 017f5ac8e499fea1b81c967d2856722a1d75e90bb3baf911dd2aafb692f82af48c241dc1ae676eb9c3e19f64854303dad36d74f04110c2c3d7171bf34ba7d384
SSDEEP 393216:SMvKQs0TcJTrGSkEyt9THylk7kmN+FXf7gZS5j/aWcA3:1vKQyJTjkx9jyMoXf7cStao3
TLSH
T1450733653E5162FB93378352B9A7CB00600E56A77F34D78B40B86D3C65813EA08BE5DE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

<- NjRAT 0.7d Horror Edition ->

Botnet

Victim

1.0.0.721:6522

Mutex

99f38bbe0af13fde32226e71d4a6ac11

Attributes

reg_key
99f38bbe0af13fde32226e71d4a6ac11
splitter
Y262SUCZ4UJJ

Targets

- Target
  njRAT 0.7d Horror Edition/NjRat 0.7D Horror Edition.exe
- Size 15.4MB
- SHA256 7e3f7d005480ab3b1f694acbab8ced2f9ccd400feacac0d16b1563f243d9a801
- MD5 ca8ea727d524bbcea3e7381bff63e1d1
- SHA1 0e9c0fb26e198af8f54c7838a7ae462a0d1cb2da
- SHA512 04beb9d7c57ca13b74826027fdf11e7a3ad274e301ac74e19b62bce4692970a1ca558c534d1028282ab45859b45a4c8906946ae48da69d02496cd043078b927d
- SSDEEP 196608:nRw3r2kYvaKqgAyoSxX3NYeOu2kYJBnnim//7uVtFZ03MtV0Poiv5m:cHZgA+9ecWBnnim//7w03M4Fv5m
- TLSH
  T186F6AD02B292D911E07E56F4D6E28BF606B5BD0EE935827725903F29BDF27C16C027C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

victim discovery njrat trojan
- Family: njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
behavioral1
- Target
  njRAT 0.7d Horror Edition/Plugin/Clip.exe
- Size 13KB
- SHA256 88b7a47f63f149d273015f4f6ce9ef8c5a731b6cf19db7a95220298603000b8c
- MD5 fd829592c5abc1361c2f5e81b2678019
- SHA1 91b6d23bc43332bb7fee1b2d924a5c26a86747e4
- SHA512 4e3e3b3cbfc2c25ac23399d15dcb6e7b40e5572fe9e5e741152f20589cd94de390fe0bea4abfb53ff427c6dec366d41a43a3a67ccdbb34c139f781be0b6b6c34
- SSDEEP 384:Gr+hl2K2kTjnbkHWUWb1Lc4WrYk90/RxLKNrw:GrYSWUWbJ5//KNrw
- TLSH
  T15952181153E5C37BCDFF1AB15C73A78202B1DA469526DB6D98CC905A0EA338807D3BE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral2
- Target
  njRAT 0.7d Horror Edition/Plugin/Lock.exe
- Size 16KB
- SHA256 c9f03a39789f7322ae43604db6ce7da86765ad4b13207091683cf47bdea8de12
- MD5 683bcb1f86f4410931abe39a63eb7057
- SHA1 d338aac5ff479fc94d3c840e862665de1dac8c8f
- SHA512 60b596947d93fdb196fcf338af92d26cdd82396283316352ead078ce1a85943bb85264901318f7061e6b0e49058ace521831a9275c025526373d9168c757cdd2
- SSDEEP 384:wi9N5yF4C0n7QLweis5rul02mXlBbVVaXI:wi3kWv7UB92KaXI
- TLSH
  T14F7228A18398D37BC8FF1FF68D73220006B1C7514917DFAD5C9D616A4AA73588383BA2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  njRAT 0.7d Horror Edition/Plugin/Screamer1.exe
- Size 844KB
- SHA256 00201a2fd4916193c9c7bbba7be6a77fa5876085480b67da4e1228fd8b23ae5f
- MD5 8cac1595b184f66d7a122af38d5dfe71
- SHA1 e0bc0162472edf77a05134e77b540663ac050ab6
- SHA512 88d3753ce73bbf95ee1fdbdff21eb9331e59ca92cfa5c489f141c07dc90871e3032e331c9dd77b1fec4522add3ac25c51d5c699d7801a5343dd2ae447c60f8f8
- SSDEEP 24576:Twbdh4Y2uoLtciBtgFD3O7iPTr8pYocr6x:T212uohceaYg
- TLSH
  T13E05DF67E0040E32C499933E2863773243345C28EF670B2456D8FD696ADF9F86769BE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral4
- Target
  njRAT 0.7d Horror Edition/Plugin/Screamer2.exe
- Size 345KB
- SHA256 c1badbacd2abe44fe4e8685c8eee7e983bf8b6780cfca03ae31f8fcebc98b1fb
- MD5 8efb7339fe13cf8cea9f6445776655c0
- SHA1 081afd73c757c83825cf1e8ed4a4eab259d23b97
- SHA512 2a37e74aeff17b4f435d02a30019a017a4ff4fa29fc898229f6195876f53b38154c063cf052deebcc06785650f875d67eeb0de372a76df3c4e71bd4fc0392956
- SSDEEP 6144:1sp3sCQ1AWnK1NOZ2l8iQojWaCZ0pak0l1aNmN4/nzNRH91FHlHH:1Ii1Az18YDQ1aq0ok0d+nzN
- TLSH
  T182745A27E1050E32C488833E64A3A73547244C29FF670B1466C8FDA86EDF9F4675ABE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5
- Target
  njRAT 0.7d Horror Edition/Plugin/Screamer3.exe
- Size 280KB
- SHA256 5dc4f19b34a738b4eef99c1229b2c7e7492040819d92ddbbf52bbde2a600c2ed
- MD5 dedabad13c1c4cc92c4ed2122473eb8a
- SHA1 a13385641ddcbdc371dce3607381883d52ed9822
- SHA512 45b66665cb3e484c82775c9972f444b1d8fe6f7ef5a55185a3c071f84e9f5dd2a039c9f9e26392e950585cbf965b987df9c789106bddcb35ee55ad0ff91b190b
- SSDEEP 6144:gk8SnpZqjGNklsppH1eSqkeJRH91FHlHH:gvgZqJmTeSqkeJ
- TLSH
  T192541727E0050E32C889833E5463A73647204C29FF670B1466D8FDB86ADF6F46B59BE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral6
- Target
  njRAT 0.7d Horror Edition/Plugin/Screamer4.exe
- Size 961KB
- SHA256 0d635f035cdb2fd3afda768cd631481ff980957b614a3cf3fca6c592c6c06470
- MD5 4723c3c04794c09bbcb6e03f48440f15
- SHA1 a5ef69c9dc9eacc2099d9c239146a0e360f1837f
- SHA512 5b68e1cd3d6bb85b5f449014cc288423faea76ff0ecf8834047dac1ed6e84c4d858a7ed23abe3625d781391f636893736bf5c00474ad0995e75611c1557c5c4a
- SSDEEP 24576:V1ubnylucMp90zjW7tDVF/ZeHr7aNnX/Xq7PU:V4bnylucasuDNnX/q
- TLSH
  T16F25EF27F5010E22C889933E6463B73553204C18FF670B1466C8FDA869DF6F8A759BE6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral7
- Target
  njRAT 0.7d Horror Edition/Plugin/Screamer5.exe
- Size 997KB
- SHA256 8929d3b749ff91527b8e407eff6bde4bb0bb27739313b5c0db0434cbf700dbfc
- MD5 28aaac578be4ce06cb695e4f927b4302
- SHA1 880ab0560b81e05e920f9ec1d6c0ecf5e04eaa7e
- SHA512 068698bda0543c773b36830f6760456e40e9046d9d20089ad88cb646ef5c7bd6c6716c6d59cfc7abd5bffb9129f5a7076e2f9c9b321795f224923f00b7b91374
- SSDEEP 24576:xcWLYmbwnSTHLmB1wS7pmYSOryHwC6FEUQ09E4a66:xFsoHSXw2S7wCqJ3
- TLSH
  T1F825E06BE5000E32C889833E5473B77543208C29EF670B1466C9FDA96ADF5F86719BE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8
- Target
  njRAT 0.7d Horror Edition/Plugin/Screamer6.exe
- Size 583KB
- SHA256 d88f5b00da5f05ab7f55fd7c414bb56aaf47e9f51365aaabd71f3ace3cc77523
- MD5 320b1115164e8b5e1316d86eb29cd299
- SHA1 bc046d8b14359a7a2bebdecbb819e76c47d84d1b
- SHA512 fab558cf31aa79caf8e4f6e5649e4e484de3e29bae1386aa61749b70e8c791d74b01fa964501d4755c7688d0420e932f30e36699a2fe4488fae82ee23558afd0
- SSDEEP 12288:Y7ogwYqbE3DMuR6BlTTnn9ZOKp0Ac9fEmtdyaukNU9ad:1gIcou0Tnnjr2fEmDNh
- TLSH
  T122C4BE67F1050E32C889933E5463A73153204C19FFA70B1466D8FD686ACF6F86769BE2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  njRAT 0.7d Horror Edition/Plugin/cam.dll
- Size 99KB
- SHA256 881d5afb9aa4799c73e75dcd28587dba85dd844e4137287ea48c6b66525e2638
- MD5 8ce3060686462fc72ece2701caa13e3b
- SHA1 19fc9892200de4db332ddd0c14b4b6fd9a35ccd4
- SHA512 ef38e00b054240a0d4747bfd79db860015ed027735c360de58af6889a69482109ccf74770608a2750542457ac38aa79367431ff6ca77fae44d7e3a7023f33a17
- SSDEEP 3072:31IL2SeOPGmBUMqtZabredepzZxgUPWeJP3:w2Sm/MqueepzZxgQW
- TLSH
  T12EA3091A77479B17C54C5A78C0EB2B0403F0978A6373E7CA3F6C15ACDE633425E5A68A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral10
- Target
  njRAT 0.7d Horror Edition/Plugin/ch.dll
- Size 44KB
- SHA256 7032cb496f866ec1c9304f2c3cd8859472168838a11aba1571f51875a75074af
- MD5 11fde8a47647c3bc98d57f3a9f3a97a3
- SHA1 e813c17973e77b7aa22b9f539c3c97c624acafb1
- SHA512 1401f40569db7679014ab282477a5560b3bc6f51284e501e0e878881522db102b448566bae50ab6c1027a196de410a9ac8770dfa2208d14e5dfcc3c05e766763
- SSDEEP 768:BZXGgq41SLdRX0vTeAMtNDkpUrpDwxRcNDfF6a2Txj+izh8RP3ABkP0:72gq41SLdRX0vTeAqNoC9kxmRfgrCs83
- TLSH
  T1C0238215B2C74723CA1C65B180EF356113F2978A5B33DA9A3D8842FD4ED33529F86B4A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  njRAT 0.7d Horror Edition/Plugin/fun.dll
- Size 8KB
- SHA256 57b66a81716e1737e5b8ecff2c269f00e2ca6ffbff88960e973c02f5800037cc
- MD5 ddce53e6a021aa8e146d9fce35e97e53
- SHA1 7a4c69888e821e1d775c899ec5b3fdab267c7fbd
- SHA512 a644892e51a5f09b35b3a89fee6031eeb92eb3ed5e5d05b8e06a96f0348305366f211ee959f94aaedb6f0c59608e49a1c2efb157f09cf520c43fe5455abfee15
- SSDEEP 192:qum1qx/rD8107fvhIW1PnaLyLlYe2/Ya7f:q29rD80fvrnamL7F
- TLSH
  T1B0F1D8A263D4C2B5DBB60B726C5322800A7AE359895FDB6F64CC91135E7378506E3B31
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral12
- Target
  njRAT 0.7d Horror Edition/Plugin/mic.dll
- Size 77KB
- SHA256 27528a77e27d02aadecabfdf658b2da638bb0ca2f2c60bdd9d0fd5338c1fc346
- MD5 9b376f0d44995ca15d43f7943a602fb2
- SHA1 18a2bb7d13836256bd5f39089203f18d740669d5
- SHA512 4dfb0c49816e0d0c2f7d0d76081725bd48d3713506ec51ac6c06ae7092908d14e3683d707d6f332505163fb0ade0ee6b50a355cd69c25725e829ebb23a3e93b2
- SSDEEP 1536:ZAwSxproATOoeQHshYNR1zTTxqPbKhOCjXKem:TSxpr/KoemAYxTTxqj
- TLSH
  T17873F814378B1E76C42A09BA58C73100B3B25F997337E61A2CAD11EF5D433DB9B44AE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  njRAT 0.7d Horror Edition/Plugin/plg.dll
- Size 65KB
- SHA256 13043521ed6876edf2736fc46a7c49e6b639cfa7a866ca11de26f119796cd521
- MD5 c179e212316f26ce9325a8d80d936666
- SHA1 14d08b3cda60341d1e9187fc14bd64ebefe4a5b6
- SHA512 1b5eb687a9932c82ab2e655dbc5df8ba667a023e7568dbbd13c503a54661763193bde11937f87e2e09b88d770c8357eda07589d526e6103db058038e3ce3b750
- SSDEEP 768:rVRKgRFKn3N5U2jNGUyXWI9Yi1s0sbtAEsz8CjBMiPs2T:pR3R895Npyhn1sBbtPsz8C9P
- TLSH
  T10853D80A77878625C55D177054EF512007F787872B33EA5F2CCA0B8D4E923DA4FA9B8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  njRAT 0.7d Horror Edition/Plugin/pw.dll
- Size 284KB
- SHA256 ca6367d1ab873a55ced13d7024c530bbe4a6a703813225233e59041c7ce14eaa
- MD5 ac43720c43dcf90b2d57d746464ad574
- SHA1 eae39df1c717ca74f6f04d5ca8478ea55145535a
- SHA512 9082b3cd8b36031256923c8f2bed628e9331129bbf09d111d9d02268a49e493248e5638ddee5b02da66e9159a608f8f26499ca0f736d6a369a30f71950c60d40
- SSDEEP 6144:QxY714e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMO:7ZxJ/JmSG9T8CEgdM
- TLSH
  T19454D007728BAE61D47C467123FB72D183B5AF461633D51E2EC822499B3B2D3BA41BC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  njRAT 0.7d Horror Edition/Plugin/sc2.dll
- Size 46KB
- SHA256 010b1ec566be774a2d12146f9826aa31fd7eb6ffe7b45ce5e572b2d8c7f815c3
- MD5 2d65bc3bff4a5d31b59f5bdf6e6311d7
- SHA1 43962fbeb93fc267fb1c7036a12b8c5d6f40c28a
- SHA512 b210d447cc9b4b89402a2a1d3d5e9cfe13ae897c47094be4110ed3aac109152c8a45ec138f73b703e7d3799934234cba4ca3f2439b3dd193a4cec671b9edaa6a
- SSDEEP 768:mtAX1G0UYRxIDbYDGN5/eoK79QlRfe2AfgFTMBku2T:mtAFZUYA/uW2x9CJe2BFQB
- TLSH
  T14423C602738B5B12C86C097240EB252413F19BCF1733EA4E7E8D669D5E933939F68B49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral16
- Target
  njRAT 0.7d Horror Edition/WinMM.Net.dll
- Size 43KB
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH
  T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  njRAT 0.7d Horror Edition/extracted/Res
- Size 997KB
- SHA256 52cad2ada36a7a4b8d5e653cfe1854d32210ef198561e4cf53ea1c4e5ebbb84f
- MD5 2f92eed4e2061af0961f379e9ded70d6
- SHA1 8b58dcd428759d3633a14bcfc62a8cb6deb66de5
- SHA512 909561ad25f5a4af7360004a6b259bdb70dfad4ced7fe0f39a72ed61f421bc943dce9c7215634ed12284811f36d9a5bae8d1f439412a94bbbd4c24cb4f4962ac
- SSDEEP 24576:XS9wlTzi2gQO1PMV2DCHAJ2glv9fJVOYfJSzaSArbz2jQ:C9ijgQO1PMDozYAPz2U
- TLSH
  T16F258D23F291443BD6732B369C6792F4592ABE103E2C994A37E83E0C5F763817963197
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral18
- Target
  njRAT 0.7d Horror Edition/extracted/Rpx
- Size 147KB
- SHA256 151e09c4e5d45d3d7247bedf08096ce1f8adaae59476ba1637839ead8099e53b
- MD5 4571a19fd31b61c8947490fac3b54ef2
- SHA1 a4a3026b943695189ae74344e550edd21dbdf103
- SHA512 5ad2d098f5b9097f5bab92a91b6d904bf374ae0e7c762f353b1dfc5190c8faca9072dcd330b13eb2290c70a7d27987e11c26cef7a4d05c8638817881bcad6fbf
- SSDEEP 3072:7xexpcRJvrGI2e6kQFXdhHaaKGxufkByDo1RZpwobf1Xv6IPcm9ddVMQKB:7xezsN2eY/vKoufkBy0RZpwobdT9ddVM
- TLSH
  T155E312107AC872B2F8B30B73B84691E482C27E417D92D5DE1289B9CB9FF1902A555FE1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  njRAT 0.7d Horror Edition/extracted/Rug_Packing_Reflection
- Size 11KB
- SHA256 fc5c7454261c7dd016302be92362e4cf60a3c9c6c4633c65855b3258d534af73
- MD5 63b02fbfa302ee016bc83be8f18efe77
- SHA1 61ecf0bab944dc173e2c06a0b059cc620d75fb0b
- SHA512 6a9aa2b2c74b34e43549aa31d3621c47003e370c4fffc1fe9844df347eed61c8e319a6a42e158d772b81fd19eb9d7b845e736062d7e14d404a9d74da0d5990d7
- SSDEEP 192:2V6ksZ2Bnx+XEXi5U4fkR3WZs2NDqQp3BrPNBNoGN:2XA2BnUwCfkYZs6DqAl7oK
- TLSH
  T16232D71597E8823EEE7B0BBBBC63B22102F5FB44D552D92B4C4C414FAC677508A22776
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  njRAT 0.7d Horror Edition/extracted/dotNET_Reactor
- Size 5.9MB
- SHA256 79f190a51af8a463f13ddd5a76947cf7ba2adfb8e231b37c5e0968602217a62b
- MD5 a7d69d6ddbe2586d698ebdf7f49c1afa
- SHA1 7b87de25c982d0cc42a1dde89790cd34acbcfd2e
- SHA512 2d4fb34f83d9794c38ec39f12f78b8d7c5af331aea475eaecf589f95c9e1849196a8d5252a7f9beaa596bb34ddc0c94b76a6c9092dc0fb93ec6b0af9fb66226e
- SSDEEP 49152:VXl2PFBegFNFLua2gBxnnim//7rF31inFhyNkLObEECwc0mjZ5tzCo3Eh5pfO+pD:VW5nnim//7uvwCt5tuo32v
- TLSH
  T1C6567B2076A8C911E0AE9774C3F281FF0BF0FD0BD226971B69857F6639B17425C06A5B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery
- Loads dropped DLL
- Drops desktop.ini file(s)
behavioral21
- Target
  njRAT 0.7d Horror Edition/extracted/mpress
- Size 101KB
- SHA256 2852680c94a9d68cdab285012d9328a1ceca290db60c9e35155c2bb3e46a41b4
- MD5 8b632bfc3fe653a510cba277c2d699d1
- SHA1 d6a57aa17e5eb51297def9bac04e574c1e36d9c7
- SHA512 b9ea70ed984d3b4a42eceb9f34f222b722c4c1985b79b368d769fe0fd1f19f037ffebe2cf938aa98ed450337836a7469d911848448d99223995f7fb3a9304587
- SSDEEP 3072:S0+mlNniJkkKcfqBOb65VgB183gUGQ340HpL:SvmlNn4kkeOAVA1rUGh0Hp
- TLSH
  T125A3F1A1B140A61DF98F4E39CCC7B38994D2EC21953352466573FA8F84B27E43F12B49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral22

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Family: njRAT/Bladabindi

Executes dropped EXE

Loads dropped DLL

Drops desktop.ini file(s)

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22