njrat | 2806fdedc1eed8a8c164eeafbf1863fd0e17e0fb6cc7836fa6559fff5d44debd

Sharing

Copy URL Twitter E-mail

General

Target
Ratcollection.rar
Size 69.2MB
Sample261018-wpf72asycs
SHA256 2806fdedc1eed8a8c164eeafbf1863fd0e17e0fb6cc7836fa6559fff5d44debd
MD5 3f26615175a25c39deaec9a0e647218b
SHA1 e982e03f8fff40e07d20b0fca5785461ba29221e
SHA512 b3f0a1074dc9eb3d63a3ba8e940e1320b44ab18397b6e329b7e36bf9f5a9df604f328ea4f085fa4b592b3eada803e9f62657cd7174165c89213c46d726a5f3b1
SSDEEP 1572864:5+Y5haasd+Y5h/j9a2E6PKg23h2h60Yc+MkYw1Y64VcYptyASmBqGpa:5lhilhbQ2nKg2RA6a+uwzhYvyAfBTpa
TLSH
T188F733939B812345AC48D43C568A8AAF3E4B82DB9C78C43C47BFEE5247994435FF9316
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Mutex

[RNVD]

Attributes

reg_key
[RNVD]
splitter
|Hassan|

Extracted

Family

njrat

Version

Platinum

Botnet

HacKed

127.0.0.1:6522

Mutex

Client.exe

Attributes

reg_key
Client.exe
splitter
|Ghost|

Extracted

Family

xworm

Version

Mutex

PUNN2IQKR4QL0tlR

Attributes

install_file
USB.exe
localhost
127.0.0.1

aes.plain

Targets

- Target
  stubs/Anti.bin
- Size 12KB
- SHA256 01d0bedcc943e13e341578423a2fc6848d9f63f1c5800b9a16bd64f65a1fcdde
- MD5 2170473f4f2b81e9b909996b0f459d16
- SHA1 81be2df85521167bcffd449e22db1add18e7bc5c
- SHA512 f5d879a45dfa733e264018fc4a714421e8b5fef5f8f06f2293ac327bbc4f4d09fc123a38d271bbd1dbc6e0ca206ec618027a10bf5291d7bb804862cef4aeb416
- SSDEEP 192:J1o3yrrIXd2lBBVCfA+XZm7nloYk4kNIDLR7swYoxU5R09KxK:J1o2k6BBVIA+JT4g+LRwcCRCKx
- TLSH
  T11742291577A58374CFFD0F325C6356101BBAD706CA636B3F98D8427A99E32108663E32
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral1 behavioral2
- Target
  stubs/Stub.bin
- Size 44KB
- SHA256 f9901a131548492470fab93c1d607be4d5cfa174f5b2efe2a592fddfa3af9fdd
- MD5 2ca8aa52af999240dddb9790a1f474bc
- SHA1 599fa5e9ce3f7a634543595f73dd92bd5e406d8e
- SHA512 5bad1d2bfdd6259456b8beba60a93341a6f3dab3d673bfdc6003891357e3bf1344059849c8941f532f46791d25ddd29040c5a4549ae676a80cd545471658a9e9
- SSDEEP 384:7F7RVdzu0ohd1vwyxEsvgvRpkhcaE1EgRqmVldNCJ9yko5lwWHWqb4Zz8ujoLT3m:BMDzBd7vAcIqAdQJ9O5GWHW6UkA
- TLSH
  T13F23A64DB2508574E6EF4BF1B8A162D806719057A946A10FC9F2B5E94FB3EC08710FE7
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery njrat trojan
- Family: njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
behavioral3 behavioral4
- Target
  stubs/dlentrypoint.bin
- Size 11KB
- SHA256 c8294263bb4e447f53eeb9e639dba6ec24d735d80a7d05894e8b88bd115f2970
- MD5 4a7b5a4da67c17c762cb538e6fec9ed1
- SHA1 65945d34c9484151c67f9a780c488186db4aece7
- SHA512 fcea20011c5cfc91b1f523bafe7df96a1723bab7a7bf182ba14caddd76eb658faae9a8840b9095a8f30d6ea8665e163b014649dc32dc3c0f781a435f4be11c2b
- SSDEEP 192:RFXnc1L11AvlszLq65grqZmGnloYk4KNIDLT7pnElS+Fs:RFs1LnAvlszeILy4a+LT7pElf
- TLSH
  T11B32082653858776CF3F0B72082375404BB6C306D296AB7E9DD466AA8FD72460BB3371
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5 behavioral6
- Target
  stubs/dlnormal.bin
- Size 11KB
- SHA256 0e36c6fbbc68953d2702c3d5f84eeb35912ce9a53aadf467f8df60faf51a7f5e
- MD5 2b53e572879a63aaa6ab032221a24d99
- SHA1 cecfb4dad0d128bc78369aba53839828af223ff1
- SHA512 327d26775f38f29f462c8a3a9d921ab0d89cf80527acb2ddd539d0842988f93c2cbf335a865cea893ab2a81915a95683cdfd8033f9a357aacbf0b8d3360e8188
- SSDEEP 192:3d3WKytoFQldQKDFdzG1nvlldKXZmGnloYk46NIDLRKQVuYvpxGBA:N3Wuy7FBGJvl7KJy4q+LRK6lx8A
- TLSH
  T1CB320829A7918770CFBE0BB2086775800BB6D30AC7936F3FCCD4695696E311947B2626
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

defense_evasion
- Executes a file named after a Windows system binary
  The file runs from a user directory while carrying the name of an executable that normally only exists in System32.
  defense_evasion
behavioral7 behavioral8
- Target
  Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/InjectIcon.dll
- Size 13KB
- SHA256 98348ffe70a68f69d934118a2d14b86b382d698601827a4c1d322d878d36bbdc
- MD5 83921e813f885ae1669aa0efa21f8695
- SHA1 130f59f513eb64018736c0173d45a2b524c282fc
- SHA512 f123ef9c5fd3157c6f51b1ac02d6103baa1ebd2a02e3c2d95355b15ce3730f241c0d61d1ffc07713b8d3af7600730d29049683c589c7007a9a4e7bb4707f58c3
- SSDEEP 192:OLCpu5eYPefzYTZVzunlYJL/eBvnaDNIDLTHqaf0+E+sQAE8UBscU:OL+1qe09prqNnq+LTGQY
- TLSH
  T1EB52D70693D6C332CE6E873A5C1377A45B31DE00DA52AB3F55A0B2676DB33440E93762
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10 behavioral9
- Target
  Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Mono.Cecil.dll
- Size 305KB
- SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
- MD5 851ec9d84343fbd089520d420348a902
- SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
- SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
- SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
- TLSH
  T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12
- Target
  Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/NjRat 0.7D Golden Edition - Rus.exe
- Size 1.9MB
- SHA256 c81d701c3a4d6b7bcaa40f9c92a1bcfdf2f829954cf1ca15556712fbdc792834
- MD5 8d540934a359a0480de188a748b3d573
- SHA1 556693330454d09e461b0cc16c2c8f69f7f3cd45
- SHA512 d2214389578a2928cc51b7fb098dd8d1ed4677f97a3f6bb18ec5494a3247866c400af7fe5d1a326cd25faf6090139849d3ef0fbb43c62075e5a436c0599d47b9
- SSDEEP 24576:S69t3fGD4IC7VS2s5G8xQ63UJzyS6P/qY7/:S6T3vs5txQ63OqP/P7
- TLSH
  T138950F03B302EE55E9B832F450058FA052697E4E9174C6B62A743A78E9F98D3FD913CD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral13 behavioral14
- Target
  Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Nj_users/WINDOSW_egorv_14FD549D/Keylog.rtf
- Size 6KB
- SHA256 cad44420af35930f40e7d4835eba1d472a73bcfa804e97510fdce319e8476187
- MD5 037e663c71182bd4e87ca62b5be36aba
- SHA1 97e6b63dfc663c933de67eaea339cb769197b574
- SHA512 c0db2a91d09ade1527a5997df7ecf1543d210d71c9d64490bacc17762e268ecf2bcaabb4920d6091d2fb94e9f0381fe8a5a5eb3b0feb9702894f62a1aef3c3f6
- SSDEEP 192:syfbsvssv/yfv7gBfvYfvXfvQfvCfvCfv4fv8fv/fvS2:kNMTgNmHOEU2Cvq2
- TLSH
  T1ADE1F581A966859E061B407E033B33D6179CEC6F5DFC5624BCBBD30B692A86C874F4D2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral15 behavioral16
- Target
  Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/AntiProcess.dll
- Size 16KB
- SHA256 f643ab116e7bd8515032a502b8700afb5bdbfc08fc1caa08817b3061e98b763e
- MD5 b21947a28760750689f46e071d575d07
- SHA1 6008a9ff367e7a715422d2e2f96312f1a3231a9e
- SHA512 75fd467e4be5480e7dc4ce665a50cf5fcea3c4301f17674feec866d04e0f7036efaec0feffa35fc07ab19b70ff82d133c457c88d7c776f62160bff6cf13a2399
- SSDEEP 384:0sRt7Wow+KPUhkRf1jJXMgthizKN8dhct+1W7Lf45kNQfjO8pZ3TR:xRt7Wow+KPUhkRf1jJX4dhVI/mf
- TLSH
  T1F4720817A3E6873BCFED0EB48526150483F1C3069553FF2F9DC665768AA33404B9279A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

7^/10

discovery persistence privilege_escalation
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
behavioral17 behavioral18
- Target
  Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/cam.dll
- Size 62KB
- SHA256 5f00cda5808e3fd126d452708308ddee6556cb83adaccd02efe83654a40fc641
- MD5 7eba4d9562bf7fc14f2c1bb142a1aa6f
- SHA1 7c0f49bd672100881e7340a480dc6674d5dfc862
- SHA512 5e7e9ee05674eb6a943b84437a46cd6c4dd7d63cd95bf308cd614026383eafc087590f6238a5282e275cf1875038aaa46ef843a5c6d322e3b7b1a63e2d454830
- SSDEEP 1536:CfGJpkk261SBIAPVQfiZba2epz5B7hzUzaQo:QGJt3MIAdZbLepz5BlzUz5
- TLSH
  T126534C6E6798541AC58D46BC94770F1053F0CA1EA337EB8E2B7891BCCDB23814A5379B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral19 behavioral20
- Target
  Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/ch.dll
- Size 23KB
- SHA256 3bc2898da9cd9e202b7795b330fa3daff81a4b02ab4ecfe47fdd712c53252f12
- MD5 2490eda5b4450138ba79f39fcc90048a
- SHA1 f8af994fdeeb8afbf7d95e816da389a7eb09806e
- SHA512 4f96028666bcb0a80730e8429082c2ab839fe8662086ad9735641fe8e55d51f909171124b1500c1da4065f26a9d3118c8b6c24d1827d12c5c887cd1e358a2d58
- SSDEEP 384:B3RxTVz/Cn1CfWok/7+I98wxOaPlXfNIsGwPEvMnNKp9p:fxTVzK10N69XfNIUUpz
- TLSH
  T19EB2F81963E5C762CCFD07790862621167F2CD51DB13EF6F2ED870E92AB37048B4269A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral21 behavioral22
- Target
  Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/mic.dll
- Size 48KB
- SHA256 7d327985d7e4f83adffbdf831c1e999c68cb90238790b63260af19d24bfa66b8
- MD5 1607999c56366fc2096a27a8bd237b98
- SHA1 0e0a61c55c6a7e8fecaa2053afeaf816095374a2
- SHA512 d30a642f26307f16a88782de2635b6e7b852dcbc90975c3920d61468dde06ed921074d95bd9d3b3b058ce4ce54973254370830d68f94a0d56b5072e82b890b85
- SSDEEP 768:fI3iafm1WcNQtd53fddlGemdITB8l/zkgQM8QRyHQuhwWCTxqPbojlfB:H1WcGyem7QXMryHQvWCTxqPbojl
- TLSH
  T19D23D6407A981CBAC52F067D7CE71621F6B18D64A327E26B1CBD60F718877DE96006F2
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral23 behavioral24
- Target
  Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/plg.dll
- Size 28KB
- SHA256 6f8770a35ec0845226a28dd57c8ae414dc8814a6871bd0bb818bb13ca3b82106
- MD5 04cb30a874ee349721b0398594de65fe
- SHA1 8f3272e318edd73c1f4194f3a90143e18f158e10
- SHA512 a69b3bc0e30ddaae10478626ac231b214864b722c9254d932a81ea1016f4f49cf04551d17cbe93819f9e1bd88f679fdc1f5446761c7065e2b0d30a8b7edf40ae
- SSDEEP 768:l78dTGdbp1AD8CYDMxelHpWuVP1eksWwnb9s7:+5hD8C2MxeSidBeb9s
- TLSH
  T162D2D70D2BA4C925C5BE57359D2223224FF346134817FF6E4CCF9AEC19A23884B56A5F
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral25 behavioral26
- Target
  Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/pw.dll
- Size 251KB
- SHA256 3a1cc072effd8c38406a6fddf4d8f49c5366bb0e32071311d90db669940987ce
- MD5 872401528fc94c90f3de6658e776cc36
- SHA1 c58e22158774d16831350de79eb4e1711379e8a6
- SHA512 6da881fb968ba9d9200777a9f19d69220468482f3eaaf687c433790d512da520f5adb23441fdc8f3fd10785918eb2864ea3ef32ddb80d2f6665550ea455f4a2f
- SSDEEP 6144:/e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMO1:WxJ/JmSG9T8CEgdM
- TLSH
  T16C44E02722CE3CA1E17E4A7033B353C2C3A9DD108612D51E29D83556AA7E1D37A42FD6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral27 behavioral28
- Target
  Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/Plugin/sc2.dll
- Size 12KB
- SHA256 f97aadb4d1c59f4b3155a9ec57f91a05700aed38b0090096f8f1e0e7975b6561
- MD5 9c8b5c9ec7d24ef02c7df4e589dba366
- SHA1 6f939463f40343cf62afc072978c833ee864914f
- SHA512 a4bf281274c22b41b8faf0cbe7559c5a62bd7614bcc06cdc29f8f28419010bdadcb70a850886b4be9d7b6edb370fb34283a5f0991a1320edbaa12b5a194f8196
- SSDEEP 192:dUFqUAbp57yUnWcL90wG1YL7ANg5egmdOnB61f8a54qwynam0q61pLWnVG:dUcNWcL90wG10MNg5PTM1Ea54qwOaz2G
- TLSH
  T1A242F80D6F88C613E7AD0ABD26A3431593B6C1664312FB5B5ECE74F569AA7C202083D5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral29 behavioral30
- Target
  Ultimate-RAT-Collection-NjRat/njRAT v0.7d Golden Edition - Rus/njRAT v0.7d Golden Edition - Rus/WinMM.Net.dll
- Size 43KB
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH
  T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Targets

Family: njRAT/Bladabindi

Executes a file named after a Windows system binary

Creates a file in the Startup directory

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32