njrat | 4a6ba5a1b484be5e51bde495518b46f56abc53c34291551c25c3eb0c5e930d2a | Triage

Sharing

General

Target

2f31e85aa9c78b6e90e11b5c5c03ca6c.exe
Size

37KB
Sample

220929-zapseachap
MD5

2f31e85aa9c78b6e90e11b5c5c03ca6c
SHA1

9689697f566c5d213b6c2711fb7b24db200892ac
SHA256

4a6ba5a1b484be5e51bde495518b46f56abc53c34291551c25c3eb0c5e930d2a
SHA512

ac16652707cc8d8103e9e77ee9114c5020143afc9536d3d7800271a412e4ceef641fb1989f6e68383a262a10e4dd0e72cdc8fd326cef4747356e9d482f08698b
SSDEEP

384:afunz6dgibXjpPu7w9qyMTA3/r6s2cLrrAF+rMRTyN/0L+EcoinblneHQM3epzXZ:r+NN9ZMTA3W1cvrM+rMRa8NutXt

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

8.tcp.ngrok.io:12006

Mutex

e5b461e898ede89ab7bb3c41c44aaf10

Attributes

reg_key
e5b461e898ede89ab7bb3c41c44aaf10
splitter
|'|'|

Targets

- Target
  
  2f31e85aa9c78b6e90e11b5c5c03ca6c.exe
- Size
  
  37KB
- MD5
  
  2f31e85aa9c78b6e90e11b5c5c03ca6c
- SHA1
  
  9689697f566c5d213b6c2711fb7b24db200892ac
- SHA256
  
  4a6ba5a1b484be5e51bde495518b46f56abc53c34291551c25c3eb0c5e930d2a
- SHA512
  
  ac16652707cc8d8103e9e77ee9114c5020143afc9536d3d7800271a412e4ceef641fb1989f6e68383a262a10e4dd0e72cdc8fd326cef4747356e9d482f08698b
- SSDEEP
  
  384:afunz6dgibXjpPu7w9qyMTA3/r6s2cLrrAF+rMRTyN/0L+EcoinblneHQM3epzXZ:r+NN9ZMTA3W1cvrM+rMRa8NutXt
Score

10^/10

njrat hacked evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedevasiontrojan

behavioral2