njrat | d8f808e63b9e607455acee2fcff7de8f1794f656034a0a860f3c1fa33abd96f5

Sharing

Copy URL Twitter E-mail

General

Target
NjRat 0.7D Error 404.rar
Size 4.4MB
Sample261030-1h2bvaff29
SHA256 d8f808e63b9e607455acee2fcff7de8f1794f656034a0a860f3c1fa33abd96f5
MD5 6fae36e7822a852a50592ad4c1e01069
SHA1 afea3028b868b244f42d39fc48cf2569aed72b1e
SHA512 3c41b39eb912ebc161e3ee5d9406331c0fc26a0e5f08d063127bcb208cca9c6381be5e9de12122c76f267fea11412336917231ade60c2859f46671314c799936
SSDEEP 98304:dS8YVuNd/VSFN59z+JP+W6Yc1LMM8XvC23Ewf+ymT+tU:dSUNdYPIP7Sedv++tU
TLSH
T1A52633102A7C5B5F947C31144DB8DE395834AEA7C19B79363CD3980B32B729D62B84EB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

127.0.0.1:6522

Mutex

60c28f2ec9c1d3d7f391e11534af955e

Attributes

reg_key
60c28f2ec9c1d3d7f391e11534af955e
splitter
Y262SUCZ4UJJ

Targets

- Target
  NjRat 0.7D Error 404/NjRat 0.7D.exe
- Size 9.3MB
- SHA256 489db926ac0420a76ff682ceb90003a78dd2a02e42c254a2aae4fc234bb013e6
- MD5 ce53474089a9756898a43d473638dccf
- SHA1 22cafe1b5e69c2a0ceea58642e722b53744df694
- SHA512 df437ce1ac935d78ba9a0495a568e63cf204117aaefd6397a00b67fbd1aaec876ba7150380e7ea4a52370f80bf506c76f347d0d01e9a50acb2676b8bd5f69701
- SSDEEP 98304:SodZrxZERMDoMu2EW5nnim//7uvwCt5tuo32vIoZp:SodjE6nnim//7uVtFw
- TLSH
  T1B8A66A12B296D914E1BA53F4D2E1C2FA06B4BD0ED134863B25D43E6B79F1B917C02BC6
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

mybot defense_evasion discovery njrat persistence privilege_escalation trojan
- Family: njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
behavioral1
- Target
  NjRat 0.7D Error 404/Plugin/cam.dll
- Size 99KB
- SHA256 881d5afb9aa4799c73e75dcd28587dba85dd844e4137287ea48c6b66525e2638
- MD5 8ce3060686462fc72ece2701caa13e3b
- SHA1 19fc9892200de4db332ddd0c14b4b6fd9a35ccd4
- SHA512 ef38e00b054240a0d4747bfd79db860015ed027735c360de58af6889a69482109ccf74770608a2750542457ac38aa79367431ff6ca77fae44d7e3a7023f33a17
- SSDEEP 3072:31IL2SeOPGmBUMqtZabredepzZxgUPWeJP3:w2Sm/MqueepzZxgQW
- TLSH
  T12EA3091A77479B17C54C5A78C0EB2B0403F0978A6373E7CA3F6C15ACDE633425E5A68A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral2
- Target
  NjRat 0.7D Error 404/Plugin/ch.dll
- Size 45KB
- SHA256 3c088df7119c494e3df95af42456225f4dab1c3abe003869f8c79afb0993b027
- MD5 2fe4b9dbd31f83faa7aa1c692ba4d3a2
- SHA1 1b3c03e29302a0f07acb4af306a7ad42ea4827dd
- SHA512 cd169dc1d2d5cf0f538334b8ac31817ea1a4e2c8c0faca6a715c63eb4aa464e8aaa4f6b10fe030f46a37ab18a1cd6fe099c662c727e107cb87ada1a8218bc5fb
- SSDEEP 768:FjTkCC7kDA87eqVlviNDkpI/pDwxRcNDRQt40BthZWMaGOQKgB22T:dkCC7kDA87eqVlviNo2hkxmRRQthBt3O
- TLSH
  T1E7238315B2874313CA2C65B540DF352413F3978A5B33DA9A7D8C02FD5ED23929F86B8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral3
- Target
  NjRat 0.7D Error 404/Plugin/mic.dll
- Size 77KB
- SHA256 27528a77e27d02aadecabfdf658b2da638bb0ca2f2c60bdd9d0fd5338c1fc346
- MD5 9b376f0d44995ca15d43f7943a602fb2
- SHA1 18a2bb7d13836256bd5f39089203f18d740669d5
- SHA512 4dfb0c49816e0d0c2f7d0d76081725bd48d3713506ec51ac6c06ae7092908d14e3683d707d6f332505163fb0ade0ee6b50a355cd69c25725e829ebb23a3e93b2
- SSDEEP 1536:ZAwSxproATOoeQHshYNR1zTTxqPbKhOCjXKem:TSxpr/KoemAYxTTxqj
- TLSH
  T17873F814378B1E76C42A09BA58C73100B3B25F997337E61A2CAD11EF5D433DB9B44AE9
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral4
- Target
  NjRat 0.7D Error 404/Plugin/plg.dll
- Size 65KB
- SHA256 13043521ed6876edf2736fc46a7c49e6b639cfa7a866ca11de26f119796cd521
- MD5 c179e212316f26ce9325a8d80d936666
- SHA1 14d08b3cda60341d1e9187fc14bd64ebefe4a5b6
- SHA512 1b5eb687a9932c82ab2e655dbc5df8ba667a023e7568dbbd13c503a54661763193bde11937f87e2e09b88d770c8357eda07589d526e6103db058038e3ce3b750
- SSDEEP 768:rVRKgRFKn3N5U2jNGUyXWI9Yi1s0sbtAEsz8CjBMiPs2T:pR3R895Npyhn1sBbtPsz8C9P
- TLSH
  T10853D80A77878625C55D177054EF512007F787872B33EA5F2CCA0B8D4E923DA4FA9B8A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral5
- Target
  NjRat 0.7D Error 404/Plugin/pw.dll
- Size 284KB
- SHA256 ca6367d1ab873a55ced13d7024c530bbe4a6a703813225233e59041c7ce14eaa
- MD5 ac43720c43dcf90b2d57d746464ad574
- SHA1 eae39df1c717ca74f6f04d5ca8478ea55145535a
- SHA512 9082b3cd8b36031256923c8f2bed628e9331129bbf09d111d9d02268a49e493248e5638ddee5b02da66e9159a608f8f26499ca0f736d6a369a30f71950c60d40
- SSDEEP 6144:QxY714e31bXJVFJmShoCKFdZ3aDGjXsCUjguhyUOMO:7ZxJ/JmSG9T8CEgdM
- TLSH
  T19454D007728BAE61D47C467123FB72D183B5AF461633D51E2EC822499B3B2D3BA41BC5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral6
- Target
  NjRat 0.7D Error 404/Plugin/sc2.dll
- Size 46KB
- SHA256 010b1ec566be774a2d12146f9826aa31fd7eb6ffe7b45ce5e572b2d8c7f815c3
- MD5 2d65bc3bff4a5d31b59f5bdf6e6311d7
- SHA1 43962fbeb93fc267fb1c7036a12b8c5d6f40c28a
- SHA512 b210d447cc9b4b89402a2a1d3d5e9cfe13ae897c47094be4110ed3aac109152c8a45ec138f73b703e7d3799934234cba4ca3f2439b3dd193a4cec671b9edaa6a
- SSDEEP 768:mtAX1G0UYRxIDbYDGN5/eoK79QlRfe2AfgFTMBku2T:mtAFZUYA/uW2x9CJe2BFQB
- TLSH
  T14423C602738B5B12C86C097240EB252413F19BCF1733EA4E7E8D669D5E933939F68B49
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

3^/10

discovery
behavioral7
- Target
  NjRat 0.7D Error 404/WinMM.Net.dll
- Size 43KB
- SHA256 59e2ac1b79840274bdfcef412a10058654e42f4285d732d1487e65e60ffbfb46
- MD5 d4b80052c7b4093e10ce1f40ce74f707
- SHA1 2494a38f1c0d3a0aa9b31cf0650337cacc655697
- SHA512 3813b81f741ae3adb07ae370e817597ed2803680841ccc7549babb727910c7bff4f8450670d0ca19a0d09e06f133a1aaefecf5b5620e1b0bdb6bcd409982c450
- SSDEEP 768:LyasDzF2TDSemqD9tGI+ffwj2Au0LVpqmf7KxcOOrYCPTxqPb85:LyaXKemqD9tGI+ffwj2Au0LVpq4KWrlv
- TLSH
  T1EB13B60479A85CB9CB2F013D6CD61211FAB18D647227B62B1CBE70F318977DE9A41AF1
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral8