njrat | 65775c3bb48b84b7d3cc49fe4dbda739721ee6a9bb401a5352c8ddaa30cbed4d | Triage

Sharing

General

Target

65775c3bb48b84b7d3cc49fe4dbda739721ee6a9bb401a5352c8ddaa30cbed4d
Size

31KB
Sample

220520-3nm3hshca2
MD5

6955b2a45017c2222c4597114db081ff
SHA1

372f7cda076acfe22f1b0dd7f83ae1c267a0f811
SHA256

65775c3bb48b84b7d3cc49fe4dbda739721ee6a9bb401a5352c8ddaa30cbed4d
SHA512

f00413f7545ab947acbb87bbcbaedc712e4923ee5bcb256730fddaad222680e4e5e19179cb9a841e3c8bad9677be00c10ac667967a833f719e36c03f07bd3441

Score

10^/10

njrat q evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

q

Mutex

2fddf94343dded05227b585c3a4e54e8

Attributes

reg_key
2fddf94343dded05227b585c3a4e54e8
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  65775c3bb48b84b7d3cc49fe4dbda739721ee6a9bb401a5352c8ddaa30cbed4d
- Size
  
  31KB
- MD5
  
  6955b2a45017c2222c4597114db081ff
- SHA1
  
  372f7cda076acfe22f1b0dd7f83ae1c267a0f811
- SHA256
  
  65775c3bb48b84b7d3cc49fe4dbda739721ee6a9bb401a5352c8ddaa30cbed4d
- SHA512
  
  f00413f7545ab947acbb87bbcbaedc712e4923ee5bcb256730fddaad222680e4e5e19179cb9a841e3c8bad9677be00c10ac667967a833f719e36c03f07bd3441
Score

10^/10

njrat q evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njratqevasionpersistencetrojan

behavioral2

njratqevasionpersistencetrojan