njrat | a836f921462e6240150cd6c26d59a8e57f2a2f5c4f520568622e3fe4e2828ceb | Triage

Sharing

General

Target

a836f921462e6240150cd6c26d59a8e57f2a2f5c4f520568622e3fe4e2828ceb
Size

3.2MB
Sample

220415-clgvlsghcr
MD5

763831ebb67edc0547d2caf7c7b999b8
SHA1

c7af5d05e46416cc2a0c33c8b09eb872c7b70a91
SHA256

a836f921462e6240150cd6c26d59a8e57f2a2f5c4f520568622e3fe4e2828ceb
SHA512

25004abb59bd61d8991d435d0428269f40b9afb21c9da1e658b83eb79c34f9e246fa2ef45573d05997839f37a15d470ff8e177e9bcc1166562310ced7199495a

Score

10^/10

njrat q evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

q

C2

ratchomli.hopto.org:3632

Mutex

631447834c0607d77dbc354603149bca

Attributes

reg_key
631447834c0607d77dbc354603149bca
splitter
|'|'|

Targets

- Target
  
  a836f921462e6240150cd6c26d59a8e57f2a2f5c4f520568622e3fe4e2828ceb
- Size
  
  3.2MB
- MD5
  
  763831ebb67edc0547d2caf7c7b999b8
- SHA1
  
  c7af5d05e46416cc2a0c33c8b09eb872c7b70a91
- SHA256
  
  a836f921462e6240150cd6c26d59a8e57f2a2f5c4f520568622e3fe4e2828ceb
- SHA512
  
  25004abb59bd61d8991d435d0428269f40b9afb21c9da1e658b83eb79c34f9e246fa2ef45573d05997839f37a15d470ff8e177e9bcc1166562310ced7199495a
Score

10^/10

njrat q evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njratqevasionpersistencetrojan

behavioral2

njratqpersistencetrojan