njrat | 1e2a19b62e2d8470f69398e17932a2b7577f9979543afd48acd5656e5f818a7a | Triage

Sharing

General

Target

1e2a19b62e2d8470f69398e17932a2b7577f9979543afd48acd5656e5f818a7a
Size

159KB
Sample

211219-r66rssgea7
MD5

bba52befc06eda6fcfced205f4dffa93
SHA1

b303f812814162f950325369f103ce26d9cce730
SHA256

1e2a19b62e2d8470f69398e17932a2b7577f9979543afd48acd5656e5f818a7a
SHA512

16e03c3c97ca2c3148c3dbe916fb2ae92bcc3dac5cb856a9f0b37dc5cd403b76aa7bebf9c3c7bcec34d8c6acc64619e527872182235117533d362478e67d7a65

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  1e2a19b62e2d8470f69398e17932a2b7577f9979543afd48acd5656e5f818a7a
- Size
  
  159KB
- MD5
  
  bba52befc06eda6fcfced205f4dffa93
- SHA1
  
  b303f812814162f950325369f103ce26d9cce730
- SHA256
  
  1e2a19b62e2d8470f69398e17932a2b7577f9979543afd48acd5656e5f818a7a
- SHA512
  
  16e03c3c97ca2c3148c3dbe916fb2ae92bcc3dac5cb856a9f0b37dc5cd403b76aa7bebf9c3c7bcec34d8c6acc64619e527872182235117533d362478e67d7a65
Score

10^/10

njrat evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratevasionpersistencetrojan