njrat | 7abdf39ec8fcb1c2226276659f7e5ed0863dd5e17ce152103d272b7cd5f22a2c

Sharing

Copy URL Twitter E-mail

General

Target
njRAT v0.7.rar
Size 1.2MB
Sample261008-samvgs1v2p
SHA256 7abdf39ec8fcb1c2226276659f7e5ed0863dd5e17ce152103d272b7cd5f22a2c
MD5 bb7c26572a351815d2833e0c75d2f95d
SHA1 676c41147f37af2b89b3a7a8d6e8f808a2208283
SHA512 0ce32ba6a7668be8045fa88bbad7e16f7996930972ae88e02701301bf37b17929d8f6c9817f35f1555fded7f86d3acf1a9ee36d3bc901d00b163acbd845f9897
SSDEEP 24576:Bz80ijcrPSI6xBOaeqLmn+smfPe2CjlINDNJnlO:Bw0iIrPh6xBa+soLmlmNJnk
TLSH
T1EC45334DA062496F3B1E03ACB097EEAF775EE60510D730DF8560D03BAF5162A4B0967B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

127.0.0.1:5552

Mutex

279f6960ed84a752570aca7fb2dc1552

Attributes

reg_key
279f6960ed84a752570aca7fb2dc1552
splitter
|'|'|

Targets

- Target
  نجرات777/Plugin/cam.dll
- Size 63KB
- SHA256 7a4977b024d048b71bcc8f1cc65fb06e4353821323f852dc6740b79b9ab75c98
- MD5 a73edb60b80a2dfa86735d821bea7b19
- SHA1 f39a54d7bc25425578a2b800033e4508714a73ed
- SHA512 283e9206d0b56c1f8b0741375ccd0a184410cf89f5f42dfe91e7438c5fd0ac7fa4afbb84b8b7ea448b3093397552fd3731b9be74c67b846d946da486dcf0df68
- SSDEEP 1536:7EoML5LFXbUu5ExN3hep+cx4sKcuxpSe:7ERZxQxep+cx5Kcu3
- TLSH
  T15153286E6B98A11AC18D52BC50B74F4007F1D64AA323EB4A6B7851FCDD733808B5379B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  نجرات777/Plugin/ch.dll
- Size 12KB
- SHA256 6e31148cc1b3235b71731c3944a7b06f861e104e978708d12c695ec09b5b3760
- MD5 e747fa3339c1f138b6bfce707b541d03
- SHA1 b95c54fbd6eb20ba4b4e69736b574baa2699ab8e
- SHA512 b970c3e8bf6a2e3ae920bc8bd014edb86ca92c85a2bccff732c7e5eb2f81ffbd902a34a0a68bd51545954b5f4d6dd1bb84b5c005868c0659717eba2892a67355
- SSDEEP 192:pc/uGfMx2+zkUakpBZHrPzYuPYrDq+PzDuGRDAVEBP6jUvsB3npn3mNFcTf:wuGk2oakpBZHrPzYuPYrW+bDPRDiEBPE
- TLSH
  T15642D62577A88B63C96DA77D45A2534133F3D1118222DFAB7DCA68EC4DE63C51B0039B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4
- Target
  نجرات777/Plugin/mic.dll
- Size 50KB
- SHA256 b6fb6b66821e70a27a4750b0cd0393e4ee2603a47feac48d6a3d66d1c1cb56d5
- MD5 d4c5ddc00f27162fc0947830e0e762b7
- SHA1 7769be616d752e95d80e167f2ef4cc6b8c3c21fe
- SHA512 9555f800213f2f4a857b4558aa4d030edf41485b8366812d5a6b9adcc77fc21584e30d2dd9ce515846f3a809c85038958cb8174bf362cf6fed97ca99a826e379
- SSDEEP 1536:YmXfC5RemUFTxqPbSiQZrCF1HzGL17d8:YmXfCgFTxq+iQZrGTGL17d8
- TLSH
  T10033B4547A981DBAC11F123DACDB1261F6B18D64B223F37B1CE960F358833DA96416F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral5 behavioral6
- Target
  نجرات777/Plugin/plg.dll
- Size 28KB
- SHA256 ea9ecf8723788feef6492bf938cdfab1266a1558dffe75e1f78a998320f96e39
- MD5 0cbc2d9703feead9783439e551c2b673
- SHA1 4f8f4addd6f9e60598a7f4a191a89a52201394a8
- SHA512 06f55b542000e23f5eeba45ea5ff9ffaddddd102935e039e4496af5e5083f257129dab2f346eeae4ee864f54db57d3c73cf6ed1d3568087411203769cf0ddd66
- SSDEEP 384:iLa+IgaVdBJfFfZsDNujglHdUky5P6bL2XIadYweVqJE+La7gmlweR9Oq7Bp2RhG:8ZIgYdbfAhdGJ6bL6YT2fO9vca2kSs
- TLSH
  T185D2C70D27A0C525C7BE87365E2143225EF786134C25FF2E4CCB4AED5EA2789DB4864B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7 behavioral8
- Target
  نجرات777/Plugin/pw.dll
- Size 39KB
- SHA256 a3e4bee1b6944aa9266bd58de3f534a4c1896df621881a5252a0d355a6e67c70
- MD5 db87daf76c15f3808cec149f639aa64f
- SHA1 d67f84a44ddc25432ce179aeba9cff778af746ee
- SHA512 ad7dc75254180ff7c988b7f394ad76b696384002457d558469d2c6401dd97cba54c532245bb555ab28d2beda3ab504736bb2b89040a21ba6598929392daab473
- SSDEEP 768:fqcFOkBO3jzamnEjt0Wp8em0nktiwRnKSg42+:fvg3jumny0Wp8em08NBgG
- TLSH
  T10F037D067BC69301EABD8FB51CB281444372D28F5D13E79E1CE988F42B76B900955BEB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  نجرات777/Plugin/sc2.dll
- Size 12KB
- SHA256 3e5141c75b7746c0eb2b332082a165deacb943cef26bd84668e6b79b47bdfd93
- MD5 19967e886edcd2f22f8d4a58c8ea3773
- SHA1 bf6e0e908eaad659fdd32572e9d73c5476ca26ec
- SHA512 d471df3f0d69909e8ef9f947da62c77c3ff1eb97ac1dd53a74ad09fb4d74ec26c3c22facc18ec04f26df3b85b0c70863119f5baa090b110ab25383fcdb4e9d6e
- SSDEEP 192:3SDU/WQw9hM/BIlbzMmY3CX80B2/mZLks4LX08Lt6dD5DHqKlZTFzfpni48nafL8:3SDOOMJIpIm8/IQs4z08IdD5DvZTFTpM
- TLSH
  T10342080DBF48C217EA5C0B79167317519373C0560303EFABAECEA4F669AA3C516183C6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  نجرات777/WinMM.Net.dll
- Size 43KB
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH
  T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  نجرات777/njRAT v0.7d.exe
- Size 1.6MB
- SHA256 bf853789b938bdc5da8aaeb52511379a332c7cf238266a21bfcb0318a62e85cb
- MD5 473e1a7be89c3a727176d4f9f5a64b69
- SHA1 501eb2c1432ff2b4e5ff582ad82d0fca152adebc
- SHA512 4d0ef049c83fe2790e8c201c643b68be26ae854feaeb154e7b1703c9f7c7250abc7307cef035f723fe8d5cf9d85175ff19a7bd37c403536617c8df9f9a7079fd
- SSDEEP 24576:IB4Uzr6UeRmmZg8ADHWsJuFfo5jYbYzHSG/UpnMUnFz3Y/l0:7w+
- TLSH
  T1F785B39333889955F03861F374A44BA045611FBEA7206DBD38B027D1EDE52CFB958BCA
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

hacked defense_evasion discovery njrat persistence privilege_escalation trojan
- Family: njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral15 behavioral16
- Target
  نجرات777/stub.il
- Size 228KB
- SHA256 daa4362a762a472f717a480102883382b41dc5c17484f649272c5bdb5142917c
- MD5 2041e64bffccfbc9379235fdf294f188
- SHA1 19c1fd78e8f36493e2a9b1c0e437afc2416586f8
- SHA512 c5d5be4615767483432287d3486e805d6744d45a5eac6445cef87ce1e8475bcdbb521dcd8d1c7918d8d73d6634617842b67290bc4fb734a4ab31dfe7daaaec13
- SSDEEP 6144:AdCb38V4N80EC7PAdpJZrLZ9u4zDdyxGu8VnNQUC:AdCb38V4N80EC7PAdzZrLZ9u4zDdyxGG
- TLSH
  T1DB34EF2D8228999AD4B2701DBA72CB16F76F12270F716C967CEFD254BF322C54270636
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

execution
behavioral17 behavioral18