njrat | d388962e41b68de23540dd2807d4eab44e96f20937dd3efca21d47e5d70da7b5 | Triage

Sharing

General

Target

d388962e41b68de23540dd2807d4eab44e96f20937dd3efca21d47e5d70da7b5
Size

9.5MB
Sample

220630-wj98xsfaaq
MD5

1f85d0c1a3ebd335c279120179f08e63
SHA1

1b2cf3fdfd62414edf4b65d2c6525c3b9ba6260a
SHA256

d388962e41b68de23540dd2807d4eab44e96f20937dd3efca21d47e5d70da7b5
SHA512

d8a80a0037d9a218d8de6f2d40c9665e92497d041919a19aa0adb44b69004bfeac61528bfe410a267151b9a878c9aeecaa4d8177cfc3c6257c6f4b15c69837ac

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:1177

Mutex

212683d986fb740ad6a40184df48e604

Attributes

reg_key
212683d986fb740ad6a40184df48e604
splitter
|'|'|

Targets

- Target
  
  d388962e41b68de23540dd2807d4eab44e96f20937dd3efca21d47e5d70da7b5
- Size
  
  9.5MB
- MD5
  
  1f85d0c1a3ebd335c279120179f08e63
- SHA1
  
  1b2cf3fdfd62414edf4b65d2c6525c3b9ba6260a
- SHA256
  
  d388962e41b68de23540dd2807d4eab44e96f20937dd3efca21d47e5d70da7b5
- SHA512
  
  d8a80a0037d9a218d8de6f2d40c9665e92497d041919a19aa0adb44b69004bfeac61528bfe410a267151b9a878c9aeecaa4d8177cfc3c6257c6f4b15c69837ac
Score

10^/10

njrat hacked evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedevasionpersistencetrojan

behavioral2

njrathackedevasionpersistencetrojan