njrat | b05ad7a7bdeb9f4217dcf68f73817db032d55b9884f2ba69f40967af0abe218f | Triage

Sharing

General

Target

b05ad7a7bdeb9f4217dcf68f73817db032d55b9884f2ba69f40967af0abe218f
Size

31KB
Sample

220524-sxms1abfdl
MD5

1ff8cbbd10873bd03aa7a2a8972536de
SHA1

64bb92321f86dae87d5cd4a3deb667a0eb5b5bdd
SHA256

b05ad7a7bdeb9f4217dcf68f73817db032d55b9884f2ba69f40967af0abe218f
SHA512

04226169bd38741c440a4956b2d3c740da06811d5aada571defec3c0cbed759ef78fce394506eaeb523014cf6ddc1672a943ee72f6c988de9c4556d30e7c373b

Score

10^/10

njrat hacker evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

hacker

C2

gugu.zapto.org:6522

Mutex

673a2b1b4c3514163eac4c9951b69533

Attributes

reg_key
673a2b1b4c3514163eac4c9951b69533
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  b05ad7a7bdeb9f4217dcf68f73817db032d55b9884f2ba69f40967af0abe218f
- Size
  
  31KB
- MD5
  
  1ff8cbbd10873bd03aa7a2a8972536de
- SHA1
  
  64bb92321f86dae87d5cd4a3deb667a0eb5b5bdd
- SHA256
  
  b05ad7a7bdeb9f4217dcf68f73817db032d55b9884f2ba69f40967af0abe218f
- SHA512
  
  04226169bd38741c440a4956b2d3c740da06811d5aada571defec3c0cbed759ef78fce394506eaeb523014cf6ddc1672a943ee72f6c988de9c4556d30e7c373b
Score

10^/10

njrat hacker evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackerevasiontrojan

behavioral2

njrathackerevasiontrojan