njrat | 0a879891619d76fb44805c30dfd2b06f35f846aebcdd3b140b0f36f0472ee52b | Triage

Sharing

General

Target

0a879891619d76fb44805c30dfd2b06f35f846aebcdd3b140b0f36f0472ee52b
Size

25KB
Sample

220520-fa4f1sdbgj
MD5

1295c8661fb1792769c369f0981b163d
SHA1

92d571375ceab3495cbde48f997052577aeaa217
SHA256

0a879891619d76fb44805c30dfd2b06f35f846aebcdd3b140b0f36f0472ee52b
SHA512

7b7a062288f20457bbd7d299fad4e385767f47741c4df0d614f23cd329e3ce4c58f2769ae29831a1cd7f3435fcde35375462d796ce51036bb436a86a8bd4dd2d

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

37.78.180.49:27017

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Targets

- Target
  
  0a879891619d76fb44805c30dfd2b06f35f846aebcdd3b140b0f36f0472ee52b
- Size
  
  25KB
- MD5
  
  1295c8661fb1792769c369f0981b163d
- SHA1
  
  92d571375ceab3495cbde48f997052577aeaa217
- SHA256
  
  0a879891619d76fb44805c30dfd2b06f35f846aebcdd3b140b0f36f0472ee52b
- SHA512
  
  7b7a062288f20457bbd7d299fad4e385767f47741c4df0d614f23cd329e3ce4c58f2769ae29831a1cd7f3435fcde35375462d796ce51036bb436a86a8bd4dd2d
Score

10^/10

njrat hacked persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedpersistencetrojan

behavioral2