njrat | 72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616 | Triage

Sharing

General

Target

72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616
Size

32KB
Sample

220201-p5cffsaabl
MD5

216832fb0d4a2660207d1d3129d3df9e
SHA1

909235013e83dad057fedc4ce3d4a64ac3dbd88c
SHA256

72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616
SHA512

054f69b044a8192663720927e5e46dad0199a30164b0a595dab0a1da9e6d9019c20bcfba2c43e6cb01de397d18698a6aa5aa67bc3faa3db598658753ad5821f3

Score

10^/10

njrat hacked by hidden person evasion persistence trojan

Malware Config

Extracted

Family

njrat

Botnet

Hacked By HiDDen PerSOn

Mutex

3a7cf98516f6e8ccf3f592aaa4ca5cb5

Attributes

reg_key
3a7cf98516f6e8ccf3f592aaa4ca5cb5

Targets

- Target
  
  72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616
- Size
  
  32KB
- MD5
  
  216832fb0d4a2660207d1d3129d3df9e
- SHA1
  
  909235013e83dad057fedc4ce3d4a64ac3dbd88c
- SHA256
  
  72932b9f1884e066fe30966a1a3089b26208297cd6ecbfd76249d9b82b5cb616
- SHA512
  
  054f69b044a8192663720927e5e46dad0199a30164b0a595dab0a1da9e6d9019c20bcfba2c43e6cb01de397d18698a6aa5aa67bc3faa3db598658753ad5821f3
Score

10^/10

njrat hacked by hidden person evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Sets service image path in registry
  persistence
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

hacked by hidden personnjrat

behavioral1

njrathacked by hidden personevasionpersistencetrojan

behavioral2