njrat | 9f591c45f6b22b544c5e30859f49fe48dbb608e9a72d07a7ee7d26d166b6f4de | Triage

Sharing

General

Target

821d81d24e2b0a23a702a2e05d358633
Size

23KB
Sample

201214-mzkv7rlv9e
MD5

821d81d24e2b0a23a702a2e05d358633
SHA1

ebe18ad66cff00468f7bbe41fc9e0d7763bcb151
SHA256

9f591c45f6b22b544c5e30859f49fe48dbb608e9a72d07a7ee7d26d166b6f4de
SHA512

bd0c8115776bddf58f027e7597df088acbbc5081e5129b1dc46fb99fec270c19242209674a48b6be038f5e6688c5e76666aadbca63a4080fede5c38958574172

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  821d81d24e2b0a23a702a2e05d358633
- Size
  
  23KB
- MD5
  
  821d81d24e2b0a23a702a2e05d358633
- SHA1
  
  ebe18ad66cff00468f7bbe41fc9e0d7763bcb151
- SHA256
  
  9f591c45f6b22b544c5e30859f49fe48dbb608e9a72d07a7ee7d26d166b6f4de
- SHA512
  
  bd0c8115776bddf58f027e7597df088acbbc5081e5129b1dc46fb99fec270c19242209674a48b6be038f5e6688c5e76666aadbca63a4080fede5c38958574172
Score

10^/10

njrat evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njratevasionpersistencetrojan

behavioral2

njratevasionpersistencetrojan