njrat | 9a043e6780007c738a39cfae366956da9733b99e635b6d4e1835cc915edd05e5 | Triage

Sharing

General

Target

9a043e6780007c738a39cfae366956da9733b99e635b6d4e1835cc915edd05e5
Size

31KB
Sample

220520-wkehmsbcg9
MD5

2b6d4350fcc1163fd53278c7060acc64
SHA1

1caa9fa73f0b62f447e2ce2c92a180b6ba865a78
SHA256

9a043e6780007c738a39cfae366956da9733b99e635b6d4e1835cc915edd05e5
SHA512

911bac0a0dd4facafb0f2ef2b78b7f70011c3b1eb3ce7ce594aebc435b7e2a1441fa82af598987cb1975bc3feb0af5c9a32855a21f1b382a760d27163494c4c8

Score

10^/10

njrat bot evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Bot

C2

127.0.0.1:6522

Mutex

97deb3f017dfa20dec7ce3bc0fcb445f

Attributes

reg_key
97deb3f017dfa20dec7ce3bc0fcb445f
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  9a043e6780007c738a39cfae366956da9733b99e635b6d4e1835cc915edd05e5
- Size
  
  31KB
- MD5
  
  2b6d4350fcc1163fd53278c7060acc64
- SHA1
  
  1caa9fa73f0b62f447e2ce2c92a180b6ba865a78
- SHA256
  
  9a043e6780007c738a39cfae366956da9733b99e635b6d4e1835cc915edd05e5
- SHA512
  
  911bac0a0dd4facafb0f2ef2b78b7f70011c3b1eb3ce7ce594aebc435b7e2a1441fa82af598987cb1975bc3feb0af5c9a32855a21f1b382a760d27163494c4c8
Score

10^/10

njrat bot trojan evasion persistence
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2

njratbotevasionpersistencetrojan