njrat | 691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd | Triage

Sharing

General

Target

691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd
Size

77KB
Sample

210228-6p5av2weg6
MD5

b4363c72117293e6255206899303107f
SHA1

1083c177d9bfd91ae7a66580a16ad895fb7d81ab
SHA256

691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd
SHA512

a3490667f895608a5b3c57d198f05e28c49480d2d0cf46e5930055a807a10180f13be627fbb3012ee219772dbb8b841d5f035a09323f08a8842dab1aa46d864f

Score

10^/10

njrat pbbr evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

PBBR

C2

kinholima.duckdns.org:1177

Mutex

a2677b62d1e55c91df28f4990150043c

Attributes

reg_key
a2677b62d1e55c91df28f4990150043c
splitter
|'|'|

Targets

- Target
  
  691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd
- Size
  
  77KB
- MD5
  
  b4363c72117293e6255206899303107f
- SHA1
  
  1083c177d9bfd91ae7a66580a16ad895fb7d81ab
- SHA256
  
  691d66b7cec7b920b6b5c9e2e3551bc6671c022609387a8959bcbc39fd709ebd
- SHA512
  
  a3490667f895608a5b3c57d198f05e28c49480d2d0cf46e5930055a807a10180f13be627fbb3012ee219772dbb8b841d5f035a09323f08a8842dab1aa46d864f
Score

10^/10

njrat pbbr evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njratpbbrevasionpersistencetrojan

behavioral2

njratpbbrevasionpersistencetrojan