njrat | 60e6bb34322ecf9b9db3b4079e08191d9b79d079bd78548bcd7d04aea639f030 | Triage

Sharing

General

Target

60e6bb34322ecf9b9db3b4079e08191d9b79d079bd78548bcd7d04aea639f030
Size

23KB
Sample

220730-2s34vsbga3
MD5

b689fb71432554182bb97c56a696a2c7
SHA1

a87ebc1f17508f35439d019163efd89f4ec16464
SHA256

60e6bb34322ecf9b9db3b4079e08191d9b79d079bd78548bcd7d04aea639f030
SHA512

f67b55bc4214849a23be04cdfa8cfef4bf30e3ed0d6d36de7961ef61977815861cf949346d279aa07babec0a256ab503e6b05fd490bb7af51c0e04bffb08c701

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

wlkjdaui828.ddns.net:1177

Mutex

2699e520cbd4295cbb0dda2cd9d08c81

Attributes

reg_key
2699e520cbd4295cbb0dda2cd9d08c81
splitter
|'|'|

Targets

- Target
  
  60e6bb34322ecf9b9db3b4079e08191d9b79d079bd78548bcd7d04aea639f030
- Size
  
  23KB
- MD5
  
  b689fb71432554182bb97c56a696a2c7
- SHA1
  
  a87ebc1f17508f35439d019163efd89f4ec16464
- SHA256
  
  60e6bb34322ecf9b9db3b4079e08191d9b79d079bd78548bcd7d04aea639f030
- SHA512
  
  f67b55bc4214849a23be04cdfa8cfef4bf30e3ed0d6d36de7961ef61977815861cf949346d279aa07babec0a256ab503e6b05fd490bb7af51c0e04bffb08c701
Score

10^/10

njrat hacked evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedevasionpersistencetrojan

behavioral2

njrathackedevasionpersistencetrojan