njrat | fe4a413fbe55153cea149dfc5c624c14ae0e42b16254acfbcf8075500aa97542

Sharing

Copy URL Twitter E-mail

General

Target
FelixDlc-Recode_1.zip
Size 34.7MB
Sample261101-arb57sfv2v
SHA256 fe4a413fbe55153cea149dfc5c624c14ae0e42b16254acfbcf8075500aa97542
MD5 ab9a902bfca1653d7d5e84b5891ac5ab
SHA1 def11df1b01262d3fead8b8f474263c09026d71b
SHA512 276d3b2659da77c86d4d37832a6bbf3c9a7521eb20c516e31daa4c69d04ac3b66c330bd0b81c86c7efa0ccaa080b6eb2b7a7c92dfa9a6b7f2d1a25175fee4437
SSDEEP 786432:sLZ4ESParsCDHFSvq+QGyyvSdSHf0gxbU:GZg4sCDHB+QGr6ARxg
TLSH
T1B78733BDC36C5B3DC5DBA13F1A9273808A4F1561E15116863D1A27ED31CFEA06A2B70B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  FelixDlc-Recode/FelixDlc-Recode/ThunderHack-Recode-main/gradle/wrapper/gradle-wrapper.jar
- Size 60KB
- SHA256 ed2c26eba7cfb93cc2b7785d05e534f07b5b48b5e7fc941921cd098628abca58
- MD5 365e8981fbb8626c5235f955b3b92f0f
- SHA1 44f8eda0fb915aa0ab56996d808baafa6d3f107a
- SHA512 93928b21532ef183d8d2cc16b671ca5bbed781e609ea0c4a1f9b29d1054c7c398427758918b62f22779d0a41899c6fba3265099c80bf6942d71f42bdc304ffde
- SSDEEP 1536:ADadM5vOoJwrgtwuCofcoGR+sL1c+nuh/:AudaZwuCop7Z
- TLSH
  T1AE53BF71A0E5C236F0334B39E4E71D12A87B53AE44CF623F56A82F0D97E159AC613385
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery njrat persistence privilege_escalation trojan
- Family: njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Downloads MZ/PE file
- Modifies Windows Firewall
  defense_evasion
- Creates a file in the Startup directory
  A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.
  persistence privilege_escalation
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Contacts third-party web service commonly abused for C2
  Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
behavioral1 behavioral2
- Target
  FelixDlc-Recode/FelixDlc-Recode/ThunderHack-Recode-main/gradlew
- Size 8KB
- SHA256 fb3cbfe6d066ee52bc07f62ed61ff77bde195384f52496c94280a83008d9f531
- MD5 5cbe8d6a9d3021235fecfed904e9c8e0
- SHA1 2fc590543bf4342b7769fc7e6bd16ea84973aa3e
- SHA512 94a4743c400d2443d372b59e9c8b34227267de21490e103f464cd2a28f8cb144e5ebe255a69f77e537ec2785b4280ea9ce74539d68950e51ca09dab6086b2eb2
- SSDEEP 192:SyWm7HOyzJ1XnRy26M9hI+vcHI75FwRDe7c25WW:S/mtzJZRyvMhb7FwRxm9
- TLSH
  T14F020B6357813374074506B72E9EB0EEA72152BF1F83291C749D920C372B96A61F2AED
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral3 behavioral4 behavioral5 behavioral6
- Target
  FelixDlc-Recode/FelixDlc-Recode/ThunderHack-Recode-main/gradlew.bat
- Size 2KB
- SHA256 18774a0ac0203f6893bf1db3291a0d77f06cd1b4dca2a43b51e7009da3e28cfa
- MD5 d7a461fc63ba188edf97f78829fd4652
- SHA1 4d4fbe1fc89951b51f53a220138bbd9c2b4b3937
- SHA512 2ddcc733b85fa8ff5648a57de49aa4ca035afeabbb1c668cb5003c70554ad65a07fb401fbaf14c5e377296c714bf646647b87ef1ddce7190551a013c563b110a
- TLSH
  T1235173FB370B517B1FBD0B6A7E0C45827B12A3AA1E47E30C940F840D7231B4A51C1BA1
- MD5 SHA1 SHA512 TLSH
Score

7^/10

execution
- Loads dropped DLL
behavioral7 behavioral8
- Target
  FelixDlc-Recode/FelixDlc-Recode/ThunderHack-Recode-main/src/main/resources/darwin/libdiscord-rpc.dylib
- Size 266KB
- SHA256 b10996f734b278987a146602150c39df1798147bdb6d8c76d496b1e4bfb88076
- MD5 86869f4b7dfe7f923d4ea326e4e9d685
- SHA1 dbf75aaa17ecf0d28b341338bd8909af2b9489c1
- SHA512 e917b638f8ebf67eacd22187ea15004fdc6c7087a72211cf0eb3caa13737f035f5b0026aa6317b7954fdf7639d8961898a8bc93f08b04a7df8f65f7031b2576a
- SSDEEP 3072:3bgWwHj58KJ6YNfwS9r0Wj4HDsBcrFxFH9wGwMUj76x5YgIs6MP+5Bq66v4xArhx:3bpYNkHrFk6TxyoQG04jsQ
- TLSH
  T19944D863F7949877C246A0F0AE98C3F62602F4623F3067CB53A4CA456E91EDD1F5670A
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

4^/10

defense_evasion
behavioral9
- Target
  FelixDlc-Recode/FelixDlc-Recode/ThunderHack-Recode-main/src/main/resources/linux-x86-64/libdiscord-rpc.so
- Size 646KB
- SHA256 fc5fd6b8b7951b43bec9c4b6baa53a2f5779ef1588b22768b6c5cc39fc5e7a4a
- MD5 307422408c69f0b0632c36247e9c0d7c
- SHA1 14c68ef9e2cd26c70623db6338558ac9a66418f8
- SHA512 1bf3d525ab7cb24c2bf05033d21453a0689b1239e5624e9deb4d649f433199b3b928500ff1937c3415bcd0960068ca9ad8141131227b7d1f42ea90dc4d7ca170
- SSDEEP 6144:+P2bFX/cSu28FbKOorFxHOgLsytwWaczQ2BaT23/FSdPihSs6X6Ih5Z51uyI/5:JtIFOOorXHOgLVJRaqIdqsA
- TLSH
  T1A3E41A66E1644873C20ABDF1BC7283B567612C86FF9413DE6281C6846C87B8D0F57E6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral10
- Target
  FelixDlc-Recode/FelixDlc-Recode/ThunderHack-Recode-main/src/main/resources/win32-x86-64/discord-rpc.dll
- Size 383KB
- SHA256 ad683f7ae2c912ef502fd802f256094fceaa238260115caaefb1913a13abd5e2
- MD5 2ada8e69e61889e672671ec015a54ad1
- SHA1 916bec6f2d9316652a1090d767f39edd4444c2a4
- SHA512 f4f3edf44ac098a72bbf4e5ab4370608ff5c481104ec74a36b36ccb95c6ef04ab138cef10080e2a050a3f9247a161982ae82a2fba11608ea9b0e05252402a8b3
- SSDEEP 6144:3mJ7nJu29RUHxbwFQ18S+PvHTkL5SqJJUFE+qlJakzfee1c61cBv:3mJ7nJHnU5xwQ5SKJPzf5jcBv
- TLSH
  T105845B5AFB6448B5E1679135C973854AE3B27C8D1B60D78F23A8435E2F33BA0853E721
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral11 behavioral12