njrat | 3e6bf2ed299efa3d61382560eddd264f0b3590f1772b8fe4890d20b842916557 | Triage

Sharing

General

Target

3e6bf2ed299efa3d61382560eddd264f0b3590f1772b8fe4890d20b842916557
Size

31KB
Sample

220520-1mp5daeag9
MD5

b9412ac91308dfef4b8534d10afa539c
SHA1

22da93e17b6c98cc7dd6d094e62702a2bed9daeb
SHA256

3e6bf2ed299efa3d61382560eddd264f0b3590f1772b8fe4890d20b842916557
SHA512

027ee26492004236a369534c9cf62b167aa3b2c5d9d4f152d6ed9aa8a9e925dfbdbfb474593380aa41de2da0fc7e79be326455e78ce4783457890ef68383617d

Score

10^/10

njrat test evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

test

C2

127.0.0.1:6522

Mutex

f5d1e9d41a2507cc16417a9a6cdc15f7

Attributes

reg_key
f5d1e9d41a2507cc16417a9a6cdc15f7
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  3e6bf2ed299efa3d61382560eddd264f0b3590f1772b8fe4890d20b842916557
- Size
  
  31KB
- MD5
  
  b9412ac91308dfef4b8534d10afa539c
- SHA1
  
  22da93e17b6c98cc7dd6d094e62702a2bed9daeb
- SHA256
  
  3e6bf2ed299efa3d61382560eddd264f0b3590f1772b8fe4890d20b842916557
- SHA512
  
  027ee26492004236a369534c9cf62b167aa3b2c5d9d4f152d6ed9aa8a9e925dfbdbfb474593380aa41de2da0fc7e79be326455e78ce4783457890ef68383617d
Score

10^/10

njrat test evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrattestevasionpersistencetrojan

behavioral2

njrattestevasionpersistencetrojan