njrat | 7710fe25a244fd73bb664e21d58f5dec2d27587e1b2b54f52a333cf45321ec9c | Triage

Sharing

General

Target

7710fe25a244fd73bb664e21d58f5dec2d27587e1b2b54f52a333cf45321ec9c
Size

3.2MB
Sample

220630-vhw48sdagq
MD5

5703b6c257e7106df52fcafd4eb4e0b9
SHA1

d412d907b36549f0e4de204dd94fa223267d98e7
SHA256

7710fe25a244fd73bb664e21d58f5dec2d27587e1b2b54f52a333cf45321ec9c
SHA512

c6201c433ff847500fcfe7667fa40eb52a2c4eef79a1eb8b8728e4530a49b81c986c9e9919e5d95e1b5d9944311fb2cfbf62292b02f3e053e1e05ecc286ec7b2

Score

10^/10

njrat бабка накурилась снюса evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

Бабка накурилась снюса

C2

192.168.0.101:7777

Mutex

f4367709f71cab5962d73e82b78e6814

Attributes

reg_key
f4367709f71cab5962d73e82b78e6814
splitter
|'|'|

Targets

- Target
  
  7710fe25a244fd73bb664e21d58f5dec2d27587e1b2b54f52a333cf45321ec9c
- Size
  
  3.2MB
- MD5
  
  5703b6c257e7106df52fcafd4eb4e0b9
- SHA1
  
  d412d907b36549f0e4de204dd94fa223267d98e7
- SHA256
  
  7710fe25a244fd73bb664e21d58f5dec2d27587e1b2b54f52a333cf45321ec9c
- SHA512
  
  c6201c433ff847500fcfe7667fa40eb52a2c4eef79a1eb8b8728e4530a49b81c986c9e9919e5d95e1b5d9944311fb2cfbf62292b02f3e053e1e05ecc286ec7b2
Score

10^/10

njrat бабка накурилась снюса evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njratбабка накурилась снюсаevasionpersistencetrojan

behavioral2

njratбабка накурилась снюсаevasionpersistencetrojan