njrat | 703dca09e84a98247353b177d81f8b9db8b995a53230e1d78f86418c90d2ed58 | Triage

Sharing

General

Target

703dca09e84a98247353b177d81f8b9db8b995a53230e1d78f86418c90d2ed58
Size

55KB
Sample

220201-gghzbsabf4
MD5

b1ca74cde30f793a2e4de455ada781e0
SHA1

050f6fdbb2008406b7ce2688ac9c4e8c714e2587
SHA256

703dca09e84a98247353b177d81f8b9db8b995a53230e1d78f86418c90d2ed58
SHA512

66166ead2cad5cf36183f93c0ddca46eb4952f3e1e6cb9f4291c38f92cfb73a65df70ab69bf8198a893b24c983fa05de286b58c331685358fea05c809a002ee9

Score

10^/10

njrat random persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

random

C2

jayayy.ddns.net:58606

Mutex

2074ba7075011291d33a57aa49f7bcaa

Attributes

reg_key
2074ba7075011291d33a57aa49f7bcaa
splitter
|'|'|

Targets

- Target
  
  703dca09e84a98247353b177d81f8b9db8b995a53230e1d78f86418c90d2ed58
- Size
  
  55KB
- MD5
  
  b1ca74cde30f793a2e4de455ada781e0
- SHA1
  
  050f6fdbb2008406b7ce2688ac9c4e8c714e2587
- SHA256
  
  703dca09e84a98247353b177d81f8b9db8b995a53230e1d78f86418c90d2ed58
- SHA512
  
  66166ead2cad5cf36183f93c0ddca46eb4952f3e1e6cb9f4291c38f92cfb73a65df70ab69bf8198a893b24c983fa05de286b58c331685358fea05c809a002ee9
Score

10^/10

njrat random trojan persistence
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Sets service image path in registry
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njratrandomtrojan

behavioral2