njrat | 816b68815e27c0f0599698fcd978526d4e340c91208dd3cd06d88429d99bb91c | Triage

Sharing

General

Target

816b68815e27c0f0599698fcd978526d4e340c91208dd3cd06d88429d99bb91c
Size

37KB
Sample

220520-2es2qsfbh9
MD5

687256c30b6bc6d544a7a87db1f1fd63
SHA1

c0a94a26040ad562b522052f5776f0ac7fbfcf35
SHA256

816b68815e27c0f0599698fcd978526d4e340c91208dd3cd06d88429d99bb91c
SHA512

89bfac44e84b1070760b4a9c8b8f4e47d305c2e2709b671dfabbdcfee0c85e37531a33cfed9b578316f47b83c4f0bbf77e9f2fbdafce91eb436b85c7c88238b7

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

192.168.0.60:5552

Mutex

dcd9ff3b6e5ea7c0a92708c0a2f08a9c

Attributes

reg_key
dcd9ff3b6e5ea7c0a92708c0a2f08a9c
splitter
|'|'|

Targets

- Target
  
  816b68815e27c0f0599698fcd978526d4e340c91208dd3cd06d88429d99bb91c
- Size
  
  37KB
- MD5
  
  687256c30b6bc6d544a7a87db1f1fd63
- SHA1
  
  c0a94a26040ad562b522052f5776f0ac7fbfcf35
- SHA256
  
  816b68815e27c0f0599698fcd978526d4e340c91208dd3cd06d88429d99bb91c
- SHA512
  
  89bfac44e84b1070760b4a9c8b8f4e47d305c2e2709b671dfabbdcfee0c85e37531a33cfed9b578316f47b83c4f0bbf77e9f2fbdafce91eb436b85c7c88238b7
Score

10^/10

njrat hacked evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedevasiontrojan

behavioral2

njrathackedevasiontrojan