njrat | f68d863a9eebbaf7615a7b9c974f5a778a8fff581c6cbc6188e2c01671b267ab | Triage

Sharing

General

Target

f68d863a9eebbaf7615a7b9c974f5a778a8fff581c6cbc6188e2c01671b267ab
Size

37KB
Sample

211219-r67dbshdap
MD5

55d94ffcf330917328c6a586d6534d25
SHA1

63d64293d07ceac441a14a52b713397bd99175b7
SHA256

f68d863a9eebbaf7615a7b9c974f5a778a8fff581c6cbc6188e2c01671b267ab
SHA512

2e677009cafb95ea0f045ef39f7afc843aa2dbb687928a23bfa082276232e23f5b806c2aa62d44b1c2d29ebc5081670111500f976ee36ffe6fe1acbd59a02e3f

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

185.204.1.234:5555

Mutex

e5a45bd689be1f7ca7b7912ac4ee9051

Attributes

reg_key
e5a45bd689be1f7ca7b7912ac4ee9051
splitter
|'|'|

Targets

- Target
  
  f68d863a9eebbaf7615a7b9c974f5a778a8fff581c6cbc6188e2c01671b267ab
- Size
  
  37KB
- MD5
  
  55d94ffcf330917328c6a586d6534d25
- SHA1
  
  63d64293d07ceac441a14a52b713397bd99175b7
- SHA256
  
  f68d863a9eebbaf7615a7b9c974f5a778a8fff581c6cbc6188e2c01671b267ab
- SHA512
  
  2e677009cafb95ea0f045ef39f7afc843aa2dbb687928a23bfa082276232e23f5b806c2aa62d44b1c2d29ebc5081670111500f976ee36ffe6fe1acbd59a02e3f
Score

10^/10

njrat hacked evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedevasiontrojan