njrat | d867671babf45616c23413f2a5d29fbe4d1e3589ce9478401f079f7ea87a60b8 | Triage

Sharing

General

Target

a0773d50f38708b79d24505a5313c575.exe
Size

43KB
Sample

220827-ayhlkacfg9
MD5

a0773d50f38708b79d24505a5313c575
SHA1

2ac3d329285f806a2f825643a54a5e49edc15942
SHA256

d867671babf45616c23413f2a5d29fbe4d1e3589ce9478401f079f7ea87a60b8
SHA512

baf14ca0b95e598c07821f470c5d03dd62ea5bdfa2b588767013ccecf8bf8eada89850985a9a1e5d0f2e2e9675c98a916a944bc4d544917121492b5b04aa8282
SSDEEP

384:LZybN5ctOnwtOyW6n5yciAEm3VOEE8472IBzgIij+ZsNO3PlpJKkkjh/TzF7pWn2:l6qAwt/W65yciAEmFOg479uXQ/op3+L

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

5488.hopto.org:1604

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Targets

- Target
  
  a0773d50f38708b79d24505a5313c575.exe
- Size
  
  43KB
- MD5
  
  a0773d50f38708b79d24505a5313c575
- SHA1
  
  2ac3d329285f806a2f825643a54a5e49edc15942
- SHA256
  
  d867671babf45616c23413f2a5d29fbe4d1e3589ce9478401f079f7ea87a60b8
- SHA512
  
  baf14ca0b95e598c07821f470c5d03dd62ea5bdfa2b588767013ccecf8bf8eada89850985a9a1e5d0f2e2e9675c98a916a944bc4d544917121492b5b04aa8282
- SSDEEP
  
  384:LZybN5ctOnwtOyW6n5yciAEm3VOEE8472IBzgIij+ZsNO3PlpJKkkjh/TzF7pWn2:l6qAwt/W65yciAEmFOg479uXQ/op3+L
Score

10^/10

njrat hacked persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedpersistencetrojan

behavioral2

njrathackedpersistencetrojan