njrat | 306291e8befd3ca365e5bee82db0222708b5be37947f4290a13aab004c1f85b0 | Triage

Sharing

General

Target

29bc26c70ff98a045451952aa657e425
Size

23KB
Sample

201214-kblf44t9ze
MD5

29bc26c70ff98a045451952aa657e425
SHA1

c9e931e5ead070d6c888e4c90deb13d7c41a9c1c
SHA256

306291e8befd3ca365e5bee82db0222708b5be37947f4290a13aab004c1f85b0
SHA512

92bf4929a687c0c212fdcbf2bc2f3ebd5aea133137e9885c2636c8640eef30088f6c566b5e1baee6c48fe604e4398d563ad5aa597e35e5f3674f55af8d9e3fc6

Score

10^/10

njrat vitimastrojan evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

VitimasTrojan

C2

vitimascsgocheat.duckdns.org:1177

Mutex

c549f415a1b907b683bd4b8685d5023f

Attributes

reg_key
c549f415a1b907b683bd4b8685d5023f
splitter
|'|'|

Targets

- Target
  
  29bc26c70ff98a045451952aa657e425
- Size
  
  23KB
- MD5
  
  29bc26c70ff98a045451952aa657e425
- SHA1
  
  c9e931e5ead070d6c888e4c90deb13d7c41a9c1c
- SHA256
  
  306291e8befd3ca365e5bee82db0222708b5be37947f4290a13aab004c1f85b0
- SHA512
  
  92bf4929a687c0c212fdcbf2bc2f3ebd5aea133137e9885c2636c8640eef30088f6c566b5e1baee6c48fe604e4398d563ad5aa597e35e5f3674f55af8d9e3fc6
Score

10^/10

njrat vitimastrojan evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njratvitimastrojanevasionpersistencetrojan

behavioral2

njratvitimastrojanevasionpersistencetrojan