njrat | a56b590f350305bacd33b60e5c866c5ad9fb6a318ea8d9afe5149c1a49171d6d | Triage

Sharing

General

Target

a56b590f350305bacd33b60e5c866c5ad9fb6a318ea8d9afe5149c1a49171d6d
Size

93KB
Sample

220508-wltnysecd4
MD5

acc1465e2be291e70935abc7cf4bd21c
SHA1

f9ddf1b9d275e9b17fed8057eedddda15fef4a4a
SHA256

a56b590f350305bacd33b60e5c866c5ad9fb6a318ea8d9afe5149c1a49171d6d
SHA512

9173864524173d00839dd518766136537ec82ae2637b6c2fe16788eaba72068fe08dfcbb4e15d9de0c6aa8f2bb1aa025ba2902fe8e7acb8eaad5bed39429f213

Score

10^/10

njrat hacker evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKer

C2

FRANSESCOjUuFRANSESCOjkuFRANSESCOTFRANSESCOyLjEwNAStrikStrik:MTYwNA==

Mutex

43eaed72e15ff576accb4dc56c41f93d

Attributes

reg_key
43eaed72e15ff576accb4dc56c41f93d
splitter
|'|'|

Targets

- Target
  
  a56b590f350305bacd33b60e5c866c5ad9fb6a318ea8d9afe5149c1a49171d6d
- Size
  
  93KB
- MD5
  
  acc1465e2be291e70935abc7cf4bd21c
- SHA1
  
  f9ddf1b9d275e9b17fed8057eedddda15fef4a4a
- SHA256
  
  a56b590f350305bacd33b60e5c866c5ad9fb6a318ea8d9afe5149c1a49171d6d
- SHA512
  
  9173864524173d00839dd518766136537ec82ae2637b6c2fe16788eaba72068fe08dfcbb4e15d9de0c6aa8f2bb1aa025ba2902fe8e7acb8eaad5bed39429f213
Score

10^/10

njrat hacker evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackerevasiontrojan

behavioral2

njrathackerevasiontrojan