njrat | 4de84a73f90891c2671018482c913cccd62d4483627ebaaedbe0196ae1ac1841 | Triage

Sharing

General

Target

4de84a73f90891c2671018482c913cccd62d4483627ebaaedbe0196ae1ac1841
Size

23KB
Sample

220720-x2jpcsgce4
MD5

81e650a3b9257dcd86e3df93160727c1
SHA1

e66d562839bb6b634afe5a678b9d5172c1ae617d
SHA256

4de84a73f90891c2671018482c913cccd62d4483627ebaaedbe0196ae1ac1841
SHA512

17002c5feddfdf1b63b7ac23db37ec0e775220bef829448952477299edceeed6562e376d9ec37139bedad32cf408e9616f83b2668ce07e3247077713cae98d84

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

279f6960ed84a752570aca7fb2dc1552

Attributes

reg_key
279f6960ed84a752570aca7fb2dc1552
splitter
|'|'|

Targets

- Target
  
  4de84a73f90891c2671018482c913cccd62d4483627ebaaedbe0196ae1ac1841
- Size
  
  23KB
- MD5
  
  81e650a3b9257dcd86e3df93160727c1
- SHA1
  
  e66d562839bb6b634afe5a678b9d5172c1ae617d
- SHA256
  
  4de84a73f90891c2671018482c913cccd62d4483627ebaaedbe0196ae1ac1841
- SHA512
  
  17002c5feddfdf1b63b7ac23db37ec0e775220bef829448952477299edceeed6562e376d9ec37139bedad32cf408e9616f83b2668ce07e3247077713cae98d84
Score

10^/10

njrat hacked evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedevasionpersistencetrojan

behavioral2

njrathackedevasionpersistencetrojan