njrat | c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191 | Triage

Sharing

General

Target

c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191
Size

126KB
Sample

210930-psxkvshga9
MD5

9ed1a098f59de1901780c6eb187aeac8
SHA1

0cd5d65e05043b349066c431bacf84302d96cd51
SHA256

c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191
SHA512

44280abf5e1bb9964f53c2efdf71806cfa0223939f69b6e1c10d8eccbcfaf111a412d70f8c0dc175f9f2b0e34eadafac5307554155f1e52d2eebec44716b4083

Score

10^/10

njrat @ west - hacking k.s.a @ persistence trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

@ WeSt - HaCkInG K.S.A @

C2

w187.ddns.net:22

Mutex

Intel HD Graphics Drivers for Windows(R)

Attributes

reg_key
Intel HD Graphics Drivers for Windows(R)
splitter
|-F-|

Targets

- Target
  
  c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191
- Size
  
  126KB
- MD5
  
  9ed1a098f59de1901780c6eb187aeac8
- SHA1
  
  0cd5d65e05043b349066c431bacf84302d96cd51
- SHA256
  
  c1545dbc06eb4bd3681801efd6a9c6a14f1312f1cf528f23d5b2a576fa148191
- SHA512
  
  44280abf5e1bb9964f53c2efdf71806cfa0223939f69b6e1c10d8eccbcfaf111a412d70f8c0dc175f9f2b0e34eadafac5307554155f1e52d2eebec44716b4083
Score

10^/10

njrat @ west - hacking k.s.a @ persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Hidden Files and Directories

Privilege Escalation

Defense Evasion

Modify Registry

Hidden Files and Directories

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrat@ west - hacking k.s.a @ persistencetrojan

behavioral2

njrat@ west - hacking k.s.a @ persistencetrojan