Extracted

• • Target
    njRAT v0.12G/njRAT v0.12G/Mono.Cecil.dll
  • Size 305KB
  • SHA256 cdadc26c09f869e21053ee1a0acf3b2d11df8edd599fe9c377bd4d3ce1c9cda9
  • MD5 851ec9d84343fbd089520d420348a902
  • SHA1 f8e2a80130058e4db3cf569cf4297d07d05c93e0
  • SHA512 5e1d1b953fda4a905749eff8c4133a164748ba08c4854348539d335cf53c873eae7c653807a2701bf307693a049ae6c523bd1497a8e659bdea0a71085a58a5f1
  • SSDEEP 6144:ueMQM/aMOZabe3h1PtRjAqmYVNf3yTXcYBbt6KMBhu:uF/aMDb8BtRjA7XcYNclB
  • TLSH
    T1D46429185AEC5B3ADD6F97BFD0E6581183B0F0126643E30E4BE4B2B22CB3761C95255B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    njRAT v0.12G/njRAT v0.12G/Plugin/cam.dll
  • Size 63KB
  • SHA256 7a4977b024d048b71bcc8f1cc65fb06e4353821323f852dc6740b79b9ab75c98
  • MD5 a73edb60b80a2dfa86735d821bea7b19
  • SHA1 f39a54d7bc25425578a2b800033e4508714a73ed
  • SHA512 283e9206d0b56c1f8b0741375ccd0a184410cf89f5f42dfe91e7438c5fd0ac7fa4afbb84b8b7ea448b3093397552fd3731b9be74c67b846d946da486dcf0df68
  • SSDEEP 1536:7EoML5LFXbUu5ExN3hep+cx4sKcuxpSe:7ERZxQxep+cx5Kcu3
  • TLSH
    T15153286E6B98A11AC18D52BC50B74F4007F1D64AA323EB4A6B7851FCDD733808B5379B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral3behavioral4
• • Target
    njRAT v0.12G/njRAT v0.12G/Plugin/ch.dll
  • Size 12KB
  • SHA256 6e31148cc1b3235b71731c3944a7b06f861e104e978708d12c695ec09b5b3760
  • MD5 e747fa3339c1f138b6bfce707b541d03
  • SHA1 b95c54fbd6eb20ba4b4e69736b574baa2699ab8e
  • SHA512 b970c3e8bf6a2e3ae920bc8bd014edb86ca92c85a2bccff732c7e5eb2f81ffbd902a34a0a68bd51545954b5f4d6dd1bb84b5c005868c0659717eba2892a67355
  • SSDEEP 192:pc/uGfMx2+zkUakpBZHrPzYuPYrDq+PzDuGRDAVEBP6jUvsB3npn3mNFcTf:wuGk2oakpBZHrPzYuPYrW+bDPRDiEBPE
  • TLSH
    T15642D62577A88B63C96DA77D45A2534133F3D1118222DFAB7DCA68EC4DE63C51B0039B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    njRAT v0.12G/njRAT v0.12G/Plugin/fun.dll
  • Size 21KB
  • SHA256 92a2bb77ac664dce38ef839dad9c9a3d9aece152ed432894654650ea6345fde8
  • MD5 c724c870d0d5b291a93a41252e1d46df
  • SHA1 57fe1efb9f3dae1138d8a6314a76e7f4c5368242
  • SHA512 3505cbc7b6310057e5f21466d5b4a3f0a07a5b5ba05048c6ba87a8ba87a1d213105a33b89bef1febe685a01d37432089ca43e5b377f034a8f07cea3eff7d5f1e
  • SSDEEP 384:xiHLTIdCtjOxUX5U5Ig0bDLZqCbbYLRUmEIAx4bTrU:AwdF5Ig0rXI/zU
  • TLSH
    T195A2382993E4C332CC3D17731863631217B29C819A13EF2F4FACB4AA6DB37504E52A95
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8
• • Target
    njRAT v0.12G/njRAT v0.12G/Plugin/inf.dll
  • Size 19KB
  • SHA256 9648ffd2eb53744c5f78dc8442a8bcbbe9831db1e198be370a62cbf9f51cd896
  • MD5 cef141d894400bc2e0096d1ed0c8f95b
  • SHA1 1bcef29980686dc4cf8ff13f251f1ead7ba6e2d2
  • SHA512 794e7cc5a899407414bb3bbe2f2aadbfcacdeda2eb0381249b8dd5ed342534910b85b1450f509f1d6b36109efdc82eb3ef1eba36b76ce123b1034192d871d2d7
  • SSDEEP 384:XioX36zZ00sK2qbc+LROMnDdU6cpobsTP4Fj:SC3wS0/9dcpFgj
  • TLSH
    T1A792D805F3E86028EEBD1B329EB3C7616276BE274D2EC62F09D8715D19B23404A71B61
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral10behavioral9
• • Target
    njRAT v0.12G/njRAT v0.12G/Plugin/mic.dll
  • Size 50KB
  • SHA256 b6fb6b66821e70a27a4750b0cd0393e4ee2603a47feac48d6a3d66d1c1cb56d5
  • MD5 d4c5ddc00f27162fc0947830e0e762b7
  • SHA1 7769be616d752e95d80e167f2ef4cc6b8c3c21fe
  • SHA512 9555f800213f2f4a857b4558aa4d030edf41485b8366812d5a6b9adcc77fc21584e30d2dd9ce515846f3a809c85038958cb8174bf362cf6fed97ca99a826e379
  • SSDEEP 1536:YmXfC5RemUFTxqPbSiQZrCF1HzGL17d8:YmXfCgFTxq+iQZrGTGL17d8
  • TLSH
    T10033B4547A981DBAC11F123DACDB1261F6B18D64B223F37B1CE960F358833DA96416F2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral11behavioral12
• • Target
    njRAT v0.12G/njRAT v0.12G/Plugin/plg.dll
  • Size 40KB
  • SHA256 25d1969fb395caef8d9122f9befd597d0cb93a687d7703a42f06119d92520cc4
  • MD5 a93349ba5e621cfb7a46dc9f401fd998
  • SHA1 6668b353baa6fc7aaeb30b0cf86d5e878199464d
  • SHA512 9d911ec49a0d79f2e9dd1d7d8aa119b18ad3aa74adf5027357bd2a7b187c8aee2be502debcdf0fb7b5198604a256935e91d5c2ff8ac2c32c46e1738a3d50612b
  • SSDEEP 768:52Gyq9nJOybLlGvuWLgRDuB6VxGPZSCmjpUTsFlNBZyxzbIVF9dpfo7G9Rp6oXG/:cGyq9nJOybLlGvuWLgFu4HGPZSCmjpMb
  • TLSH
    T11703B7CC67E48724D63E4B734A6177434BF99A264A42D53F4EE4F0F62AB37A48B00716
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral13behavioral14
• • Target
    njRAT v0.12G/njRAT v0.12G/Plugin/pw.dll
  • Size 243KB
  • SHA256 9e0ccd6be2a8d6eb045363c44af34e7b1482856e64b4b9cfc3deae465e3cdccd
  • MD5 11375fb0cee4c06b5cefa2031ee2ed6d
  • SHA1 4c1a4f627494715197e233775ab4dae219b2df89
  • SHA512 48e7de4d2496f39073b070b3de1370a7f4ad6837af72f5aff7e8ca6c9cffc3a2019651bb14138346779ad404e230c2254f7bda4cb9555638575ad2bec6c9c337
  • SSDEEP 6144:+e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMOy:xxJ/JmSG9T8CEgdM
  • TLSH
    T17734122E37524831D95FCD7A40A3F34263B68C619B53A61F2BE832461F735E58A42F72
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral15behavioral16
• • Target
    njRAT v0.12G/njRAT v0.12G/Plugin/sc2.dll
  • Size 12KB
  • SHA256 3e5141c75b7746c0eb2b332082a165deacb943cef26bd84668e6b79b47bdfd93
  • MD5 19967e886edcd2f22f8d4a58c8ea3773
  • SHA1 bf6e0e908eaad659fdd32572e9d73c5476ca26ec
  • SHA512 d471df3f0d69909e8ef9f947da62c77c3ff1eb97ac1dd53a74ad09fb4d74ec26c3c22facc18ec04f26df3b85b0c70863119f5baa090b110ab25383fcdb4e9d6e
  • SSDEEP 192:3SDU/WQw9hM/BIlbzMmY3CX80B2/mZLks4LX08Lt6dD5DHqKlZTFzfpni48nafL8:3SDOOMJIpIm8/IQs4z08IdD5DvZTFTpM
  • TLSH
    T10342080DBF48C217EA5C0B79167317519373C0560303EFABAECEA4F669AA3C516183C6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral17behavioral18
• • Target
    njRAT v0.12G/njRAT v0.12G/njRAT v0.12G.exe
  • Size 1.6MB
  • SHA256 f7b2462da3d8ab4f9b72709c8c9a2a31f56eab8949b34e7b5dcb99330662efac
  • MD5 0efc74cd8ccdbf57858b0e55e7c5bf8b
  • SHA1 188c4a1fd90326f396f96c953ea0fd8c6be82b48
  • SHA512 bc40782c84d918798c9ab30c48b48e5785e8565e37f121cb41dd246020b23aeff6b961a71b9ee39d98a1bb5f54d005e2dda425280ff4e7fd34f85cfa9369145c
  • SSDEEP 24576:v3gP+2pb1ADePvX00TIWSHUzPHEO/YJmGrCWpgLCUmtw7S/kSlfCt9fNAhk0yq:fc9bSqPvXneMcrbrCWpgdkD/kSlR
  • TLSH
    T1917533547B3FD254E85E2AB9471798A97B2C56CFFC41D2386AB0601708A3B0D81E3D7E
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  hackeddefense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

  • Family: njRAT/Bladabindi

    Widely used RAT written in .NET.

    trojannjrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral19behavioral20