njrat | 73ef8785ce221925db2e244da366959e541eed19f13fe85bb58892880381071c | Triage

Sharing

General

Target

73ef8785ce221925db2e244da366959e541eed19f13fe85bb58892880381071c
Size

125KB
Sample

210930-psxkvshgb2
MD5

0d2a094f6702c6723432871c12e35d79
SHA1

993881a65653a92c938116dfca5fee60c6698c81
SHA256

73ef8785ce221925db2e244da366959e541eed19f13fe85bb58892880381071c
SHA512

94157f8f392746089fb0973c9cef857a902bf3157d85ef7e8cfe6845a60f2d9ede317b99d2ea922096083bc894fa5cacaf9c7c0af51685410251b83bfcd69d4b

Score

10^/10

njrat @ west - hacking k.s.a @ persistence trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

@ WeSt - HaCkInG K.S.A @

C2

w187.ddns.net:22

Mutex

Intel HD Graphics Drivers for Windows(R)

Attributes

reg_key
Intel HD Graphics Drivers for Windows(R)
splitter
|-F-|

Targets

- Target
  
  73ef8785ce221925db2e244da366959e541eed19f13fe85bb58892880381071c
- Size
  
  125KB
- MD5
  
  0d2a094f6702c6723432871c12e35d79
- SHA1
  
  993881a65653a92c938116dfca5fee60c6698c81
- SHA256
  
  73ef8785ce221925db2e244da366959e541eed19f13fe85bb58892880381071c
- SHA512
  
  94157f8f392746089fb0973c9cef857a902bf3157d85ef7e8cfe6845a60f2d9ede317b99d2ea922096083bc894fa5cacaf9c7c0af51685410251b83bfcd69d4b
Score

10^/10

njrat @ west - hacking k.s.a @ persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Hidden Files and Directories

Privilege Escalation

Defense Evasion

Modify Registry

Hidden Files and Directories

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrat@ west - hacking k.s.a @ persistencetrojan

behavioral2

njrat@ west - hacking k.s.a @ persistencetrojan