njrat | 5cf17f3d1a5b7713a357bcd0473986e575733fdee5f10e390272793aeea92700 | Triage

Sharing

General

Target

0x000a0000000122f5-56.dat
Size

23KB
Sample

220914-ygafmabbf6
MD5

ffa4d67e73388d5573b9e55a029800ab
SHA1

929760e8f38433556280bc348609273e1d2d25e1
SHA256

5cf17f3d1a5b7713a357bcd0473986e575733fdee5f10e390272793aeea92700
SHA512

e50f469dc6ac8ed96d7f1a363823202319439e196b3689caf0a53ee4a31aab26b44c0c543e7f879b0268c9f2e6a9bc21797a3af28bb696a68f830ff9dc7dd81c
SSDEEP

384:2sqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZNHhy:Bf65K2Yf1jKRpcnumo

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

0.tcp.ngrok.io:17413

Mutex

ed0dbeeaea86b7db8fabde04117ddf70

Attributes

reg_key
ed0dbeeaea86b7db8fabde04117ddf70
splitter
|'|'|

Targets

- Target
  
  0x000a0000000122f5-56.dat
- Size
  
  23KB
- MD5
  
  ffa4d67e73388d5573b9e55a029800ab
- SHA1
  
  929760e8f38433556280bc348609273e1d2d25e1
- SHA256
  
  5cf17f3d1a5b7713a357bcd0473986e575733fdee5f10e390272793aeea92700
- SHA512
  
  e50f469dc6ac8ed96d7f1a363823202319439e196b3689caf0a53ee4a31aab26b44c0c543e7f879b0268c9f2e6a9bc21797a3af28bb696a68f830ff9dc7dd81c
- SSDEEP
  
  384:2sqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZNHhy:Bf65K2Yf1jKRpcnumo
Score

10^/10

njrat hacked evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedevasiontrojan

behavioral2

njrathackedevasiontrojan