njrat | 7075a0ad7d167b990717f95a36a1292243e649aa628d25381a3aef47a72dafd7 | Triage

Sharing

General

Target

7075a0ad7d167b990717f95a36a1292243e649aa628d25381a3aef47a72dafd7
Size

23KB
Sample

220520-faq6padbem
MD5

77cffe535a99ba32ba939db431d5fa10
SHA1

db59fefb9de005accdf660728e47d3577cf43a90
SHA256

7075a0ad7d167b990717f95a36a1292243e649aa628d25381a3aef47a72dafd7
SHA512

fa31d8f28fbb574c954507d661fa56846d5aaa258e759098d368705d044acb9e7e1c8f4f51dc90c44dc37c1e9e46c296e5ef714b9c233b443a05a7bad4e015c4

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:8808

Mutex

da73141765181666c75fcf6c94008eee

Attributes

reg_key
da73141765181666c75fcf6c94008eee
splitter
|'|'|

Targets

- Target
  
  7075a0ad7d167b990717f95a36a1292243e649aa628d25381a3aef47a72dafd7
- Size
  
  23KB
- MD5
  
  77cffe535a99ba32ba939db431d5fa10
- SHA1
  
  db59fefb9de005accdf660728e47d3577cf43a90
- SHA256
  
  7075a0ad7d167b990717f95a36a1292243e649aa628d25381a3aef47a72dafd7
- SHA512
  
  fa31d8f28fbb574c954507d661fa56846d5aaa258e759098d368705d044acb9e7e1c8f4f51dc90c44dc37c1e9e46c296e5ef714b9c233b443a05a7bad4e015c4
Score

10^/10

njrat hacked evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedevasionpersistencetrojan

behavioral2

njrathackedevasionpersistencetrojan