Overview

overview

10

Static

static

10

Builder nj...AT.exe

windows10-2004-x64

10

Builder nj...AT.exe

windows11-ltsc_2024-x64

1

Builder nj...il.dll

windows10-2004-x64

1

Builder nj...il.dll

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    Builder njRAT 0.7 MultiHost By v_B01.rar
  • Size 134KB
  • Sample261001-ysf3jsys3n
  • SHA256 f1887278d5e2e7ee551db595c6237afa80cb9d38d4e4eab22057a982a370bcc3
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
njrathackedexecutionpersistenceprivilege_escalationtrojan

Malware Config

Extracted

Family

  • njrat

Version

  • 0.7 MultiHost

C2

  • [H]:[P]

Mutex

  • [RG]

Attributes
  • reg_key

    [RG]

  • splitter

    [SPLIT]

Extracted

Family

  • njrat

Version

  • 0.7 MultiHost

Botnet

  • HacKed

C2

  • 127.0.0.1:5552

Mutex

  • 8746d62c81bb0c573a0a1086f9955c7b

Attributes
  • reg_key

    8746d62c81bb0c573a0a1086f9955c7b

  • splitter

    gdg

Targets

    • Target
      Builder njRAT MultiHost/Builder njRAT.exe
    • Size 50KB
    • SHA256 39290a484219fc7e6cc79924941032cbb93dcc6a334fa5c57efe265f6a7e7113
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    hackedexecutionnjratpersistenceprivilege_escalationtrojan

    • Family: njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Executes dropped EXE

    behavioral1behavioral2
    • Target
      Builder njRAT MultiHost/Mono.Cecil.dll
    • Size 305KB
    • SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    1/10
    behavioral3behavioral4

MITRE ATT&CK Enterprise v16

Tasks