The Increase in Activity of the Remote Access Trojan - Cyberint
Tags
cmtmf-attack-pattern: Masquerading
attack-pattern: Data Domains - T1583.001 Domains - T1584.001 Dynamic Dns - T1311 Dynamic Dns - T1333 Malware - T1587.001 Malware - T1588.001 Masquerading - T1655 Powershell - T1059.001 Server - T1583.004 Server - T1584.004 Software - T1592.002 Visual Basic - T1059.005 Video Capture - T1512 Masquerading - T1036 Powershell - T1086 Video Capture - T1125 Masquerading
Show in Graph
Common Information
Type Value
UUID b40d30ba-7c09-4405-abd6-93e8f3f46044
Fingerprint f414bb9ba1341c6d
Analysis status DONE
Considered CTI value 2
Text language
Published Oct. 27, 2020, 12:15 p.m.
Added to db Jan. 18, 2023, 8:25 p.m.
Last updated Oct. 6, 2024, 3:20 p.m.
Headline njRAT Rising – The Increase in Activity of the Remote Access Trojan
Title The Increase in Activity of the Remote Access Trojan - Cyberint
Detected Hints/Tags/Attributes 47/2/10
Source URLs
Redirection Url
Details Source https://blog.cyberint.com/njrat-bulletin
URL Provider
Details Provider Source level domain
Details cyberint.com blog.cyberint.com
Attributes
Details Type #Events CTI Value
Details Domain 1 
gracenetwork.ddns.net
Details Domain 1 
javaclients.hopto.org
Details Domain 1 
playwithme.emailonlinemoney.com
Details Domain 1 
salekhard.ddns.net
Details File 3 
crypt.php
Details sha256 1 
282b8ef6c7234d647ec37db974772afae3f0e171656458b7799ab07d81c2bf37
Details sha256 1 
33a7196538a17da13cc67b31162c14d0f3f473816b98f75f01709eda2b1464a7
Details sha256 1 
b17cb970d6a76b1be5d66fdd6bbb5336c348b596fab734c27060e77e5bbc4ac9
Details sha256 1 
f47b923a0e29fb7c86ad0c67c1260c803403c05e4607ca6d05d8b58cf697aab1
Details sha256 1 
f68ad4f6dae9a3cad88bbfd3193d613215270d21aaa0403f670edaaaad98cdbd