njrat | 46a5a182b94569e4db66ae877064a18a1ca470aa0302d400eaed02545d83c1eb | Triage

Sharing

General

Target

46a5a182b94569e4db66ae877064a18a1ca470aa0302d400eaed02545d83c1eb
Size

37KB
Sample

220707-jz6t8agbbk
MD5

ec1d28577d98caa817b98f4dbf67dbf0
SHA1

209ffb1fc2aea7d49c219d7f7a49c0db65817efe
SHA256

46a5a182b94569e4db66ae877064a18a1ca470aa0302d400eaed02545d83c1eb
SHA512

8ee0da08073bff08d36228676a7a799caae4532102ac3e965a4b17e5ecadaa4e3fcf57db8b14763610706d3e34160dbe8b89e8bfa715876240bb24da1a89ec44

Score

10^/10

njrat chrome.exe evasion trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

chrome.exe

C2

ksa-99.ddns.net:5552

Mutex

3589e0b622cc2bc3cbe0a553519de497

Attributes

reg_key
3589e0b622cc2bc3cbe0a553519de497
splitter
|'|'|

Targets

- Target
  
  46a5a182b94569e4db66ae877064a18a1ca470aa0302d400eaed02545d83c1eb
- Size
  
  37KB
- MD5
  
  ec1d28577d98caa817b98f4dbf67dbf0
- SHA1
  
  209ffb1fc2aea7d49c219d7f7a49c0db65817efe
- SHA256
  
  46a5a182b94569e4db66ae877064a18a1ca470aa0302d400eaed02545d83c1eb
- SHA512
  
  8ee0da08073bff08d36228676a7a799caae4532102ac3e965a4b17e5ecadaa4e3fcf57db8b14763610706d3e34160dbe8b89e8bfa715876240bb24da1a89ec44
Score

10^/10

njrat chrome.exe evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

chrome.exenjrat

behavioral1

njratchrome.exeevasiontrojan

behavioral2

njratchrome.exeevasiontrojan