njrat | 3c355ffa1858e6080e60e9e0005b0f2c38b0ce88ed920268a4fccc47d5b02b9c | Triage

Sharing

General

Target

3c355ffa1858e6080e60e9e0005b0f2c38b0ce88ed920268a4fccc47d5b02b9c
Size

287KB
Sample

221001-3tw8dacdh3
MD5

e455a00f81f63362705a23485b370882
SHA1

222bd85745f6ad4d132d869fffba23bcc3fcda9a
SHA256

3c355ffa1858e6080e60e9e0005b0f2c38b0ce88ed920268a4fccc47d5b02b9c
SHA512

de0ddf01c01d88349959069fdc4ce5df31a09f02e709d33219ab30d9ac82f101e66c74b7f40367438f4f8103f30353e10c9d9e6a410f164c9122365ab56ea4d4
SSDEEP

1536:luuuuuuuy6vERk2WW5MeGD7BKb7+it2dFo:luuuuuuuzvERlWWH2vW

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

bosshacker.no-ip.biz:9241

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Targets

- Target
  
  3c355ffa1858e6080e60e9e0005b0f2c38b0ce88ed920268a4fccc47d5b02b9c
- Size
  
  287KB
- MD5
  
  e455a00f81f63362705a23485b370882
- SHA1
  
  222bd85745f6ad4d132d869fffba23bcc3fcda9a
- SHA256
  
  3c355ffa1858e6080e60e9e0005b0f2c38b0ce88ed920268a4fccc47d5b02b9c
- SHA512
  
  de0ddf01c01d88349959069fdc4ce5df31a09f02e709d33219ab30d9ac82f101e66c74b7f40367438f4f8103f30353e10c9d9e6a410f164c9122365ab56ea4d4
- SSDEEP
  
  1536:luuuuuuuy6vERk2WW5MeGD7BKb7+it2dFo:luuuuuuuzvERlWWH2vW
Score

10^/10

njrat hacked evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedevasionpersistencetrojan

behavioral2

njrathackedevasionpersistencetrojan