njrat | 3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1 | Triage

Sharing

General

Target

3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1
Size

23KB
Sample

220701-h1bvssahg9
MD5

6da1b9e34be8401e656dd8a263d1857a
SHA1

c252431527c0aebb9edca387ce9ddb71d2baa311
SHA256

3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1
SHA512

48b3dfbd194b4f9cd74236cbe4f67d40b844590d3a355a491a4b1e2220a5e1d86f856569a2ca87219fb5a76233a28d66d8bf889e90b70c6c058908630d786e79

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:2222

Mutex

a2e45a7dbc044c98d46693fd415d81b0

Attributes

reg_key
a2e45a7dbc044c98d46693fd415d81b0
splitter
|'|'|

Targets

- Target
  
  3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1
- Size
  
  23KB
- MD5
  
  6da1b9e34be8401e656dd8a263d1857a
- SHA1
  
  c252431527c0aebb9edca387ce9ddb71d2baa311
- SHA256
  
  3e7f474b7b857a6365e0287b07a0b1d42562d00c719b8413bd89d902be36c2e1
- SHA512
  
  48b3dfbd194b4f9cd74236cbe4f67d40b844590d3a355a491a4b1e2220a5e1d86f856569a2ca87219fb5a76233a28d66d8bf889e90b70c6c058908630d786e79
Score

10^/10

njrat hacked trojan evasion persistence
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedtrojan

behavioral2

njrathackedevasionpersistencetrojan