njrat | 053813c8b9f738f9428d75fc1eda6a189f1926d2d77b219d4f0f98647219673c | Triage

Sharing

General

Target

053813c8b9f738f9428d75fc1eda6a189f1926d2d77b219d4f0f98647219673c
Size

23KB
Sample

220520-3a4hcagef3
MD5

a81fbdcd88ec62ad6a264e21e7634738
SHA1

51dae7eb156317ee935dfb82050b135da0288e30
SHA256

053813c8b9f738f9428d75fc1eda6a189f1926d2d77b219d4f0f98647219673c
SHA512

a54c6fb2a179b0571532b126c49b0ffeffbba07dda48fb7e19324a9424c1f5b0e2b121e9fd0145eb552d6b371480c21edf112c4d68924ad7d91afd23fa8ec51b

Score

10^/10

njrat fast.exe evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Fast.exe

C2

127.0.0.1:3158

Mutex

59a4c7d5a45bd632bb2583e1dc4664dd

Attributes

reg_key
59a4c7d5a45bd632bb2583e1dc4664dd
splitter
|'|'|

Targets

- Target
  
  053813c8b9f738f9428d75fc1eda6a189f1926d2d77b219d4f0f98647219673c
- Size
  
  23KB
- MD5
  
  a81fbdcd88ec62ad6a264e21e7634738
- SHA1
  
  51dae7eb156317ee935dfb82050b135da0288e30
- SHA256
  
  053813c8b9f738f9428d75fc1eda6a189f1926d2d77b219d4f0f98647219673c
- SHA512
  
  a54c6fb2a179b0571532b126c49b0ffeffbba07dda48fb7e19324a9424c1f5b0e2b121e9fd0145eb552d6b371480c21edf112c4d68924ad7d91afd23fa8ec51b
Score

10^/10

njrat fast.exe evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njratfast.exeevasionpersistencetrojan

behavioral2

njratfast.exeevasionpersistencetrojan