njrat | a422e2aaa598e34bd1969b60850785fda811c121f670addc5d1384936aa452f5 | Triage

Sharing

General

Target

a422e2aaa598e34bd1969b60850785fda811c121f670addc5d1384936aa452f5
Size

134KB
Sample

220129-eegx5scchq
MD5

d2d8cd908010759c378de5d945090ac6
SHA1

1c36a8a904b3c1570f8616b0b55d849175e313f1
SHA256

a422e2aaa598e34bd1969b60850785fda811c121f670addc5d1384936aa452f5
SHA512

cf8ed7585b70a2619b4af5487869bb497df8e020afbed09340d60f51c76dd90105a6c608f1adca2093f5fa0111bbea13d740254e1a026d90564bc7c7ed5da48e

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

basbas.no-ip.biz:5552

Mutex

7f3b28763aa416cc47f3cf93980140c8

Attributes

reg_key
7f3b28763aa416cc47f3cf93980140c8
splitter
|'|'|

Targets

- Target
  
  a422e2aaa598e34bd1969b60850785fda811c121f670addc5d1384936aa452f5
- Size
  
  134KB
- MD5
  
  d2d8cd908010759c378de5d945090ac6
- SHA1
  
  1c36a8a904b3c1570f8616b0b55d849175e313f1
- SHA256
  
  a422e2aaa598e34bd1969b60850785fda811c121f670addc5d1384936aa452f5
- SHA512
  
  cf8ed7585b70a2619b4af5487869bb497df8e020afbed09340d60f51c76dd90105a6c608f1adca2093f5fa0111bbea13d740254e1a026d90564bc7c7ed5da48e
Score

10^/10

njrat hacked evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedevasionpersistencetrojan

behavioral2

njrathackedevasionpersistencetrojan