njrat | a2dc89b1aa5e3b6ff023b87a45756f50c667d94e44fff760ddea39a2c07a100d | Triage

Sharing

General

Target

a2dc89b1aa5e3b6ff023b87a45756f50c667d94e44fff760ddea39a2c07a100d
Size

29KB
Sample

220701-dm8v6abdb4
MD5

c2c057d9645af7f64e9d11672840828e
SHA1

bec40dc3a800848327a19aa43414d97cf03b1dd3
SHA256

a2dc89b1aa5e3b6ff023b87a45756f50c667d94e44fff760ddea39a2c07a100d
SHA512

eb1878882d67b0534df70f56808ce728b00c674f10e95b2dae9975dc455129e74084e6824c125eb800e8ecaed7b6a755df6a4242e89db1b8a08118d173884b71

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

127.0.0.1:9090

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Targets

- Target
  
  a2dc89b1aa5e3b6ff023b87a45756f50c667d94e44fff760ddea39a2c07a100d
- Size
  
  29KB
- MD5
  
  c2c057d9645af7f64e9d11672840828e
- SHA1
  
  bec40dc3a800848327a19aa43414d97cf03b1dd3
- SHA256
  
  a2dc89b1aa5e3b6ff023b87a45756f50c667d94e44fff760ddea39a2c07a100d
- SHA512
  
  eb1878882d67b0534df70f56808ce728b00c674f10e95b2dae9975dc455129e74084e6824c125eb800e8ecaed7b6a755df6a4242e89db1b8a08118d173884b71
Score

10^/10

njrat hacked trojan evasion persistence
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedtrojan

behavioral2

njrathackedevasionpersistencetrojan