cobianrat | d80296d66a04d60a69921734d2987cdd708b5c0ffa8adc375b9f1a40f1ce9205

Sharing

Copy URL Twitter E-mail

General

Target
njRAT-All-Versions-master.zip
Size 243.5MB
Sample260930-b3vmcsxekf
SHA256 d80296d66a04d60a69921734d2987cdd708b5c0ffa8adc375b9f1a40f1ce9205
MD5 75ac7c2dac9cdc290996e78f10494bd6
SHA1 b3cba773c4ca3e04d0cdfebcd74f3940f8c76597
SHA512 17d439ccc6e0db9e0e58a80ba8ba4d80446d112f2b3680e0c6ded461709e7dc7f1469cfb3ad8d9e42235e3de6eb1afcba49857ad9c663d4ce656b9fe2539d4e9
SSDEEP 6291456:Px0d7fiNeynSh90WfUXF3M1xR0Bm3phVaEbQmYUhZlmV:PxvNjnS79fI3TByi6DAV
TLSH
T1D7C8331FC1D51ABFECDA50FD6853809BE3B865970594AEBC7E0CB1144E0FA6F488864B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

njrat

Mutex

%Cor%

Attributes

reg_key
%Cor%
splitter
|-F-|

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Mutex

[RNVD]

Attributes

reg_key
[RNVD]
splitter
|Hassan|

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

127.0.0.1:5552

Mutex

3b570ffeeb3d34249b9a5ce0ee58a328

Attributes

reg_key
3b570ffeeb3d34249b9a5ce0ee58a328
splitter
DarkNET

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed By Mr-Abu Hani

127.0.0.1:1177

Mutex

ab1af83eea933acc503ee4c0ebd9bcc1

Attributes

reg_key
ab1af83eea933acc503ee4c0ebd9bcc1
splitter
|'|'|

Targets

- Target
  njRAT-All-Versions-master/CobianRAT v1.0.40.7/Mono.Cecil.dll
- Size 305KB
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH
  T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  njRAT-All-Versions-master/Comet RAT v0.1.4/IOS/mpress.exe
- Size 101KB
- SHA256 2852680c94a9d68cdab285012d9328a1ceca290db60c9e35155c2bb3e46a41b4
- MD5 8b632bfc3fe653a510cba277c2d699d1
- SHA1 d6a57aa17e5eb51297def9bac04e574c1e36d9c7
- SHA512 b9ea70ed984d3b4a42eceb9f34f222b722c4c1985b79b368d769fe0fd1f19f037ffebe2cf938aa98ed450337836a7469d911848448d99223995f7fb3a9304587
- SSDEEP 3072:S0+mlNniJkkKcfqBOb65VgB183gUGQ340HpL:SvmlNn4kkeOAVA1rUGh0Hp
- TLSH
  T125A3F1A1B140A61DF98F4E39CCC7B38994D2EC21953352466573FA8F84B27E43F12B49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  njRAT-All-Versions-master/Dangerous RAT/FastColoredTextBox.dll
- Size 333KB
- SHA256 3701b19ccdac79b880b197756a972027e2ac609ebed36753bd989367ea4ef519
- MD5 b746707265772b362c0ba18d8d630061
- SHA1 4b185e5f68c00bef441adb737d0955646d4e569a
- SHA512 fd67f6c55940509e8060da53693cb5fbac574eb1e79d5bd8f9bbd43edbd05f68d5f73994798a0eed676d3e583e1c6cde608b54c03604b3818520fa18ad19aec8
- SSDEEP 6144:4FErOIif3RzSHh+20lXs1TzCeBcQeDbNlz7:eEeR52bmeh0n
- TLSH
  T1D274292422F84665E27F47BCD4B5A000D3FAB53699DFDB4E8B64A0DA2F63340D526633
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3
- Target
  njRAT-All-Versions-master/Dangerous RAT/Kalogar_Online/Dell-12-30-2020/Keylog.rtf
- Size 418B
- SHA256 a7b6e9c3d31de8e8f22f346f9ff38f8f0a3f258a46f563ccb5f832a715bc3a26
- MD5 2cb3d075e3e836741d45d2e0f5adcd93
- SHA1 9faaee0fb2aea0c8021b4a08d4ab9c4485001dbc
- SHA512 4c81eb27a74f8576d4f11e4a9296f4d2e4760f0b8d6779d6f3978dcd2873d11f9aeed64ce2ea7fd5a97878c609b18cdcd97b8af5b9cb9f5a1d86c6f5a9d33c26
- TLSH
  T1B3E0ABA2C3CCC36A868C860C3E08C80B4B1AD4DF68AEDC6960F3FD24904787E6215CC0
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral4
- Target
  njRAT-All-Versions-master/Dangerous RAT/Kay/Bind.dat
- Size 33KB
- SHA256 7b0d30222fd50ca8a4a5ea1af483e85ea7a332545b54344fc8fceb2e2fc2bfb9
- MD5 98dca3c1bae7b12d90e05d56e23aab17
- SHA1 4d0b3e9ef7f5e0d18bd8b97774963e89493c3494
- SHA512 d8732a9c076f6f4d2fcce6c287705923b4f3983e0ce0381a419267c43f0b17d618e513f2981b7a033b0c546fe216671f4bb4ca1980dd7575da0ee8c7a3bbb8ca
- SSDEEP 384:7L/Lu3GPLT8h16CnEkYuAu3tm9uuTMmv5Onuuuu/uuuuhuu7+sgPnEsU99uuEuu+:v63+SmnE55kQYd5c6s
- TLSH
  T1D9E2E8287B54C856C5448BB99A627330C92DDC25B79D9E87EC98B05E1E3E5E23400EFF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  njRAT-All-Versions-master/Dangerous RAT/Kay/Stub.bin
- Size 15KB
- SHA256 15ac5860a78b240b7063b95d2f701848162f21155baa9ec4d528c516bba25893
- MD5 ea2fe690956e04b29db465f14fc26690
- SHA1 d027c14e779aee5e8c3f4028417eca8d53c77c1f
- SHA512 6b4c60460b23aa063d55e1dc051fcc5dcf434c6f1d3d7b2656d48cc05246294f38f4f3477006fdc48c7c3383cc242be1bd36f96362ee57ec0de79c5f58fe2709
- SSDEEP 192:FIfeuLOlUZ+7STfJwYfStbfSNQgaZm6LKnloYU45WtIhfjrX9iv8I/0lLBP:FIfeGO7uxykMBLf45WQfjrX968/BBP
- TLSH
  T1B3622B1623F88377CAAE0B795872260507B2DA15D523FF5F6C8442AD5DF33084B53BA6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery execution
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Command and Scripting Interpreter: PowerShell
  Using powershell.exe command.
  execution
- Enumerates connected drives
  Attempts to read the root path of hard drives other than the default C: drive.
behavioral6
- Target
  njRAT-All-Versions-master/Dangerous RAT/Kay/Stub.dat
- Size 14KB
- SHA256 d76432bca73fe93e090730595e8e7e81decf40391010500ed3eb4b0d8980d2a6
- MD5 dc4b478752e593e0e246d6b61a98c14c
- SHA1 ff7f8dd6d53071382456a5289d3626975c5a4ea3
- SHA512 11168eb4244598c25f2c862df72aa18e92f16822e269644201917ba4c6b9623e1155ba45798c909e03a27a05f31a24359e4963dfdc83fbb2c8ec69bd4bb199bb
- SSDEEP 192:iFkrdkC/edZo7jUbUeu5wZmNYnloYk4suNIDLTNp7kFT7Cx23wqYn:iFWdkuec8a4sO+LTNpA8x3qY
- TLSH
  T1D462280193C54736EFAE0AB288A362501BB1C306E95BAF7F5DD852370AA37050B63B65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  njRAT-All-Versions-master/Dangerous RAT/Kay/Stub.il
- Size 277KB
- SHA256 6e6e8087faee9b91bbb2bc996feb1057321b98913266e4054ef227c86eb42ccb
- MD5 c3bb1b357fb7ffdabe2d72f67a8efdfe
- SHA1 e75a83b862d6920773cde8cf424bdb739dbf73b9
- SHA512 65d678bc75b37acab474027e24c3528d802907c5513d2523c2bc67548cb37b2debaf55beb7351980b8741868412923059df5e85f0c155e3736be42da117f3f65
- SSDEEP 3072:1zP6lrekZOtsTOpwmx0dMtTf4bKFLk1euINYXI:1zClnZOtuOpgdM9fyKFLk1fINYXI
- TLSH
  T14854BB2882289996D5B2711ABE72CB46F77F52274F71AC967CAFC244FF311888174237
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

5^/10

execution
- Executes a VBScript file via the Windows Script Host.
  execution
behavioral8
- Target
  njRAT-All-Versions-master/Dangerous RAT/Mono.Cecil.dll
- Size 305KB
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH
  T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral9
- Target
  njRAT-All-Versions-master/Dangerous RAT/NAudio.dll
- Size 382KB
- SHA256 cd9709bf1c7396f6fe3684b5177fa0890c706ca82e2b98ba58e8d8383632a3c8
- MD5 422193aabd3d62275b2b98470279d9f2
- SHA1 62ff295275cfbc07132934e473e43b0a4749ec39
- SHA512 1ac568f7448ed4a7eed1a9296a8ea132eb0bea0d5e622f80147bca701ab1212421d25a847dbc469abc4089042d3c662235be6d44b12446d174b13223a78f682c
- SSDEEP 6144:r+RsYcXreeC8Kl6jQX4ZL2dmeNVnhZD6sg++3aadCDbjuCNj2GLk:IgXfexdD+Y+dCA
- TLSH
  T168846B945BF4A967C03F23B9E4E209020779F0157967E72F0B9452FA2DA3B52CD017AB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  njRAT-All-Versions-master/Dangerous RAT/Plugin/AN.dll
- Size 15KB
- SHA256 3120498168f968b2e7a3f44ef09b9c2e99da6b3dd64b1728df20f873297b7431
- MD5 b3c721c3314d2c20ba685e6b03601467
- SHA1 8f1e158e5199394f9687f25e216213ee8172996d
- SHA512 7d71934d84a4d99d65ba03c2019632694a1bce76dc0ea95ca52db00070bfc660e66bd288b8d08928767222b74a4232cbc5019eef56952f6a522eb64ef8846eef
- SSDEEP 384:b0is/P8/d+iU1irbb09VkwqELjwF2pMT0HWSJU36:b0iu81gKbbsxi6
- TLSH
  T14662291A63B6C635CCAD277949A393421370DE428693E72F9DE8746A6CF33044F533A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11
- Target
  njRAT-All-Versions-master/Dangerous RAT/Plugin/Adf.dll
- Size 17KB
- SHA256 2c860ae1f6b9ad6f0fed907c268714cb2c2c7615d89f0733682014ec852bb3fe
- MD5 d1a3d0619a4f1c40ad0042ee0f37ce3e
- SHA1 bf86bf2d7ede77a29a75b257c4d1ead85b0d01b9
- SHA512 3023603ebd8dd527787c94eaca844c8df422a02f3da6f51c66d417a5138903bfa283c48dc64e757a63343320a80a50cdd72abc6544f5cb2c1a750f5e06781030
- SSDEEP 384:Qs/W8W+vkpJc49GjS2HLjwSBpM/bnQdWJzyg:Qn8WikrGjbqy
- TLSH
  T12882180A27E6CB75CCAD1B3448A357001772DE46DA93E76F9E98B46E5CB33008F536A1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral12
- Target
  njRAT-All-Versions-master/Dangerous RAT/Plugin/Ant.dll
- Size 14KB
- SHA256 4d962f32f94f83d52e193a191df6d0202d441773eba0969df4fcada62385baeb
- MD5 8854809c9c8f5feb776ed337761c0390
- SHA1 1ed9deb4a774852b92cfd58d769c539c583a6ec1
- SHA512 d267cf32a009155648a8aa6e011465331d37c5a349e042a2099420824bb7128a38fbf87ee3d18df39cc6de2f3a97eb5fad4568bbcf430b32833e9f7ea1bb2905
- SSDEEP 384:GgdovW5UJ0ELsElpBIx68tSzmtuxNvoF:BdoOH6kYNvoF
- TLSH
  T19052F72D63E2C226CD5C0B370443535107718E41C967AB6B1FF8B1BB6C737894F92A65
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral13
- Target
  njRAT-All-Versions-master/Dangerous RAT/Plugin/Anx.dll
- Size 20KB
- SHA256 f5e3a28d021745b4f3eb8e12f228fcba12bd01d668569f70d6c1aecd33a21777
- MD5 44d692fbbdb6885457057ee5bd5d257b
- SHA1 b861d3dcba13aa578679f69a16d251c5b3b68a6d
- SHA512 5e06c1851dd17c884fccc2bb5da12dacda4df228c7fd1853df1b17c93420ae23edb727eddfad170598c9e1367ee41e40ba1cb7f66aef3bb634fceb4c38c0363b
- SSDEEP 384:2xQ9Bb0GlHF6ar+i9gAlpBIx6wvtSz17xrtcM8MqPIM+5:H9pVF6eT9hsVi7P8MqPIH5
- TLSH
  T11D92293A13E1C27AC9AC6B3B0503630123759D01A913FB5B0FEC75BE6EB77854B92691
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral14
- Target
  njRAT-All-Versions-master/Dangerous RAT/Plugin/Cli.dll
- Size 15KB
- SHA256 8ee8407c076076b5bcd1a6f2f245a18aa5cfdbc16df19d69dc6375a0ec098533
- MD5 39c44ad43461da2127dfbb978853c210
- SHA1 af5208fcc091d0168cfd2ad131cbc810d4062b73
- SHA512 f2ba948e4c1b383d0c47acb252f2eb1e04016eeee4db39ad1f36cf8d33124a99d3369ae26416f1afa2afe7540160467f7a826a323ee3b986e24e72c90f488a49
- SSDEEP 384:cbJymHbacA1dl+ASQilpBIx6wvtSz1zPBFMClguw:EJyMbVAKQesVibMClguw
- TLSH
  T14D620929A3F38236CD9C1B3A0553A31117308E44DA53BB6F4EFCB57A5CB37884762A91
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral15
- Target
  njRAT-All-Versions-master/Dangerous RAT/Plugin/Dc.dll
- Size 23KB
- SHA256 4fe2421b3b896dfb0c1e81f2f8a2b97a9776fba3f6cdd1f97595138cc10d7d66
- MD5 a16dcbae0d7f2d40066e1528e9520ea3
- SHA1 3c50db3271b099d69e49783c8d8c240ab19f371a
- SHA512 6b368be2620624f9ba18555d927fe8f10d0aac9b0215cb35016f36d7599c825db212e9d9796389152d9bd017350cfb0ad7b1309696a2a3a868cb14bb7c78fcca
- SSDEEP 384:rx82T3sfbHOpiyjVYMlpBIx6STB6iNqkPDRk2:r3sMiyj2YiNqYDRk2
- TLSH
  T141B2A31B12DEBDE6C17C0632377393C1C32DDE054417EA2E5AD478698A7E2477A827D8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral16
- Target
  njRAT-All-Versions-master/KilerRat v7.5.4/KilerRat v7.5.4.exe
- Size 5.7MB
- SHA256 5bce89211d4a5997893ce65298950f32e576a28207877f871e662c2b5f5e4668
- MD5 b762fcb2bd6e5349a6449c92b5611ead
- SHA1 6554f8fb39e456d013435f48822b280d256acd6e
- SHA512 907aaeddb6b2cba4706a753b1d91952f580fa7b595613b2a24b789224882ad8c342bbc8fa8aef2f807a55f3a7920b6dd405b245b3d7d6d95021e243744d7ed21
- SSDEEP 98304:/nLll5hWz5zRn7za7JaCxpjo7HYFrzTzVSNvrzv:/nLll5mBRnva7JXzOKrz3a/v
- TLSH
  T1015637872750E899D9F405B5C0175BF082620D2DE8A2CBDB788C7EEA77F25C026553EB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral17
- Target
  njRAT-All-Versions-master/KilerRat v7.5.4/KilerRat_users/WIN7_A7qt_90618C30/Keylog.rtf
- Size 19KB
- SHA256 9e363098c7faf91c818c046b56a8ba7061300507d245f6077148ed46b757d2e0
- MD5 59e2acfa3309abefe77896091a455645
- SHA1 f6e498bfae3942dd6ce13d4e4fd3ee7f17620d9e
- SHA512 6b80a861a735ea824b6ac0b107494512d4672a26fa35610c14988887d116c00bb077163cd41dbaa035c6596d403c2ae886738a572d32c85b29aebcc8040903af
- SSDEEP 384:NQV5YHLRY5x5WFnDbessVvMVg7Vvhj7VP0KA1Pue8uDZGdIZpuzkpan2uHVnUILx:yV5YHLRY5x5WlDbessVvMVg7Vvhj7VP3
- TLSH
  T1B3928EF17502CB0C06AE496F456B67D54A1DBE2E4EFCA1623DCCA627B70646DDBC20E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral18
- Target
  njRAT-All-Versions-master/KilerRat v7.5.4/Mono.Cecil.dll
- Size 305KB
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH
  T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral19
- Target
  njRAT-All-Versions-master/KilerRat v7.5.4/Plugin/cam.dll
- Size 62KB
- SHA256 f7625119de43a747129977ae4bcb9a38a3bb49453afb1eafa3afaf2bc7308c05
- MD5 92eaa039cf7a25fb72ab1328032312f1
- SHA1 436ecf46f1d7f67dd42f617de305164bb7da4e06
- SHA512 62d3e26c655024badd98f1238ec1bbb193265f0481e2422c98f8524b38863c711e76be4e88f0cce7a1777a97033095a55d17dfa8586166df4b76d34191a346b0
- SSDEEP 768:umgpxrJnKYUEwHGHUrvpIKqpZ1KyJRnuPCFK12epzNLs4seBK8hwvy9xf2zRa:7gPr+BLxI1p/lJOwKUepz5B7hwyezR
- TLSH
  T1FF533B6E6754141AC28D467CA0770F0453F2C65AA323DB8A6BB941BCDEB23818B57397
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral20
- Target
  njRAT-All-Versions-master/KilerRat v7.5.4/Plugin/ch.dll
- Size 13KB
- SHA256 830aa905b8dfe782ab6805b215cfdbd196212b8b7c532367233b43cacb969057
- MD5 fe74fcca56c8af93cfddd90275d58c93
- SHA1 715be3ac12ea3d0914712332cf42dc5ed5ffcdb6
- SHA512 587ee6305f5573a0459aa0cb751323938d2fbfd0eff8bea5e68d8c1c8dec15479cad575b26b51cef196c8cd35dbd12b72c4a5e3aa3860b6cddc8aee5c2e1ad62
- SSDEEP 192:E1FflYgFIcTqmlUPyzvPlaj9E5v7o0llm8+NpnfNXNz/sgly:E1plYeIcmmC6zvIO5zo0bm8+/fNXNz
- TLSH
  T10452910672A45F33C82D97B8916297401BF3E5048322CBAB7CDCA9FE49E3345670079A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral21
- Target
  njRAT-All-Versions-master/KilerRat v7.5.4/Plugin/fm.dll
- Size 13KB
- SHA256 16685b8330897a0a1834ec01a1df0d32515d980708938e2a8aa95c30e0f63751
- MD5 91a9dcec684402b8697a0925e25a93b3
- SHA1 cd404ca95d787178aa313187a6c7cbbab6f09883
- SHA512 923603ed3d9d1512954d3bc6405bee3e179d0f8d43a9d502c5c24125b9b3f7f5696670cc020e87fbeec19cea1a98fc97e7ae8c92bc61a6f11835337474ed2edc
- SSDEEP 192:5+Iq6/NI46SlCixgSuNBOnfHWmlVk40l:5x/NIrSlY3ifHWmlVk4c
- TLSH
  T12752606CE6989D02C46D0375869E57156FB38A064616EA7F8CCC9CFF0A673C0AB487D3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral22
- Target
  njRAT-All-Versions-master/KilerRat v7.5.4/Plugin/proc.dll
- Size 8KB
- SHA256 925644e109f6b83819636dea98b01da560c8d73e84d758d716d9a8b80cb456e1
- MD5 37a001713fc1cd8c36c0ac4494174b46
- SHA1 44b216a81f139b62feef0de9c88f5ad69bfda675
- SHA512 a74d25ad8eeb94542a1175bdf6699bbf87a9b868e13347730d70ae07fe46a1bd7acefe509e2618fb8b64f83b9559110246f92aa907b22ce129974672b1db18d4
- SSDEEP 96:faiuHfG6ZWpOTytLPdDJonpoa1tgtpQmnLD6nPVJYXQvIO3BihJNnU8ZS4A3lc4:fa1RWgMNUR78a0D6nPTjIyi9nY1jK9
- TLSH
  T19102741EEBB45D22D56D0B7D84614749AFF3811A0222DB7F5CCA78EA6F8A3D01634783
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23
- Target
  njRAT-All-Versions-master/KilerRat v7.5.4/Plugin/pw.dll
- Size 37KB
- SHA256 efa05a4bb42843236ba64393be0cb5ff073baa9c71b308cfb052b2e317ac8715
- MD5 4ee1a499e903cd0cb561682b4eb68a91
- SHA1 a35866ff36a7ec0a226b8f814f3642185742020e
- SHA512 00def300ecd4c4e257bc1e7c67f6b9851853f54fc51c1da734f5927a140f4405baa10f7a6fa333013aa7cc8683cbaf14bf290d78618041955590710803c7e7f7
- SSDEEP 768:mNdzkF9F2SbQiRbb34cEyiJ3nfSgT2VY:mNdgF9k4R/34cxkag0Y
- TLSH
  T18F036C0A77C5D242EABDCA745CB2C9142370C04B6D63E78E5CD845A52B72BD11118FEF
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral24
- Target
  njRAT-All-Versions-master/KilerRat v7.5.4/Plugin/sc2.dll
- Size 10KB
- SHA256 f6124b65c05d8361d0803b776c41ce944774eedb54c3128dbaef7078aa0f3870
- MD5 991a4e7febfbc4b6c2a3690f21064d43
- SHA1 3eeea51c435159aaed5032bfe0b190669982fb49
- SHA512 115c4c607237559f13798b69eb8e8e92d1eb698214fdbe1371b8061f8152e555a48901313b895c93476cb182e3f817fbd8c2a9f60ee81be26aa2bd4439a3353f
- SSDEEP 192:FFhbTt3N/FlmfPTA67nFKaPs6v/4jnJMq3OdiW:zblaz7FKaPtv/4rJRb
- TLSH
  T1C722E81BBB888B17E92C57FE0AA383621372C1269343EB6F0CC568F959A6B8511543D9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral25
- Target
  njRAT-All-Versions-master/KilerRat v7.5.4/stub.exe
- Size 52KB
- SHA256 fd542975c8dd3b31f15533a67307cca0579dbe845b261079ec4ae414eb80d04a
- MD5 77ce709124e6c070405853eec647598e
- SHA1 ec750cdc6135458f3505670816fb04ab88857925
- SHA512 8b99b61c5aa6b5a353216644adeaceacd7613167b14df0cda2d446132545129f460fac196c71cc4518778a9f1098bc577e1426bb773cc528db0a3eed62f708ca
- SSDEEP 1536:2DC1p4Uvd6eGjl8Am7fDCvYmolo8hjPo:MUSMDEixhjPo
- TLSH
  T14533C58967D58814C47E6BBB6672B66103B5E8872A03D61F0AD0D4ED3F3B3448F846A7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral26
- Target
  njRAT-All-Versions-master/NjRat 0.7D Danger Edition/ER/Abrairnotes.dll
- Size 55B
- SHA256 321fcf894e5a1853ffb430624d3085f04025563e8e5d8ae1c9c28dbce93d5f93
- MD5 cad085eb4a51b05d3f2905c9a2996fec
- SHA1 f2c6be581eac7a2580666fd3c589f15cf6599996
- SHA512 f6e50801d3de71926568c9b225b2c83607269b716aa18b9f9af417dbb32e7160395c1f53c80c07bef2b50209ab1e92a5b6aaac46d36ab6f14e62b8e83e1503c4
- TLSH
  T14990025D5062ED6F11A5A6814087849CB16FC0D61C5784464407057D8A454415449C49
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral27
- Target
  njRAT-All-Versions-master/NjRat 0.7D Danger Edition/ER/Abrier.dll
- Size 79B
- SHA256 ed0aa6ecbb2d5d6ef3b8431d13d4562d89c2e1c88636c22dbbbbea81e32f913d
- MD5 5514b7e5a95e10c6d37278bb973651b2
- SHA1 44049d7456b90ef04b9c5c414167f1594f54bbf8
- SHA512 3b98f20638cd63612f035fe331b6bdb3ba1cb737df277da762005eb90f548f72fff43977ab502daa105ec571011e277bfdca0f34cafbdac4509ad53c8f175b56
- TLSH
  T125A0112220820A02200A88E0A0AAA080320BA3A30383ECC8282BC0308B803EC80E8823
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral28
- Target
  njRAT-All-Versions-master/NjRat 0.7D Danger Edition/ER/Apraircam.dll
- Size 83B
- SHA256 37d23694738615464be8a3234bcc59592987432c8863db67e30385b8bb3ef450
- MD5 cc795c9c4a83aa1ede067f96f1eb8d15
- SHA1 32b8e1c43787353f7d87514e279288aff5f7d4f6
- SHA512 ec0b8f6600b2b0443ea6f271fcf16804e380b6f51f3f74997dc5c53ed28ece8ece58a12686b451532ed31941a67fa075305314fba7fa8555a7fb8cf6424c6fc5
- TLSH
  T1E3A0121221814A01200C54B490699080304B62971343DCD0182AC13887C03CC80C8407
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral29
- Target
  njRAT-All-Versions-master/NjRat 0.7D Danger Edition/ER/Bipe.dll
- Size 65B
- SHA256 c1c8afde84694f203ebb49766454ce17179e32c06a0bbdd272bf598c0d9b7c0e
- MD5 4992e2814a8597fb20b5282e568a032d
- SHA1 e0e1bb5cdcc6eae4714ed420e158717be66c45fa
- SHA512 dfe05b7db512c82b5c0d996c13086133ffd70547c69f819486d311aae3d687516bc4e412f8ef7c7755456d84e37ce33d55ff30b71208335144194fc2d67db903
- TLSH
  T1AFA0021261D11E05900C7AD8E99BE4C0345B82C71347A9C8283FC474CBCBBCD91AC91B
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral30
- Target
  njRAT-All-Versions-master/NjRat 0.7D Danger Edition/ER/Delet A.dll
- Size 83B
- SHA256 fd8802c66f18b5d7175bd3eaf628c652525605be88b8149a37e7ec731f3ab963
- MD5 b256a2a73f8436243481712965f3fd48
- SHA1 696657223bc7be99c1cb275b2501850c03581001
- SHA512 aae2b68303ce9fe22f260f31f9fd5ee7edf4bdff7e99372df35a1e0d0a5a3714a915c23d8d68a97417cc5a3c431d0dac3a3c289aa74764308e63709b99d94dca
- TLSH
  T1B5A009059C4A0586A1291893208557E2A61649956F589A41028FA0E667C73466205459
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral31
- Target
  njRAT-All-Versions-master/NjRat 0.7D Danger Edition/ER/Delettemp.dll
- Size 199B
- SHA256 5cbea0f270bc1d57e2231a4d2d5e5d8323710d5757e714d5559e90dc86432c93
- MD5 5fce1e96bf39cd18ede1c35b48a90b43
- SHA1 e8e323eac6292b077c0b9af93c89dd869477a4a5
- SHA512 bd5fa97a9c67c6b342569653362b6896b7eb82be561695ba46b4975a3d0dfd2d3d3ed108e7ae4dbbf1ed7a4deeca2f54fc2477a946b124a6e5819300b553b0e0
- TLSH
  T17FD04C233019360EB04C4D34C1B49015161DD364593A5AD1CC91D8107F175C4466F3D8
- MD5 SHA1 SHA512 TLSH
Score

1^/10
behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Targets

Checks computer location settings

Command and Scripting Interpreter: PowerShell

Enumerates connected drives

Executes a VBScript file via the Windows Script Host.

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32