njrat | a6ce92c72deabf6faf87edafd72381d1daeda76db3a37b72901bdda3d2c16c4c | Triage

Sharing

General

Target

a6ce92c72deabf6faf87edafd72381d1daeda76db3a37b72901bdda3d2c16c4c
Size

31KB
Sample

220520-1nqgjaebb6
MD5

29966f080381fc0809ec8bb75365acda
SHA1

4f78c804d179070468fa9205c128208938163152
SHA256

a6ce92c72deabf6faf87edafd72381d1daeda76db3a37b72901bdda3d2c16c4c
SHA512

a1d6bc1388d7d3cfd4e8701a4adb4f8b725a4e7b38643459a2f50b6c797adf7c0f3ae2dadf5bccd129770b9aef2a395e7c2a3b7217543ba0a71772473e86181b

Score

10^/10

njrat c evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

C

C2

41.215.240.150 :7777

Mutex

9bb2a2aa276f54484f6a2c361c3d59f1

Attributes

reg_key
9bb2a2aa276f54484f6a2c361c3d59f1
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  a6ce92c72deabf6faf87edafd72381d1daeda76db3a37b72901bdda3d2c16c4c
- Size
  
  31KB
- MD5
  
  29966f080381fc0809ec8bb75365acda
- SHA1
  
  4f78c804d179070468fa9205c128208938163152
- SHA256
  
  a6ce92c72deabf6faf87edafd72381d1daeda76db3a37b72901bdda3d2c16c4c
- SHA512
  
  a1d6bc1388d7d3cfd4e8701a4adb4f8b725a4e7b38643459a2f50b6c797adf7c0f3ae2dadf5bccd129770b9aef2a395e7c2a3b7217543ba0a71772473e86181b
Score

10^/10

njrat c evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njratcevasionpersistencetrojan

behavioral2

njratcevasionpersistencetrojan