njrat | be522b3b527e3a969ce3150c8def6fa91d517140e77f7b62f8914154bcb920b5 | Triage

Sharing

General

Target

be522b3b527e3a969ce3150c8def6fa91d517140e77f7b62f8914154bcb920b5
Size

29KB
Sample

221003-qykzpaheg6
MD5

6df7834b15218a8b3c3777ca7c085980
SHA1

a074a0f43a29de95c0c56693689943f123771a7f
SHA256

be522b3b527e3a969ce3150c8def6fa91d517140e77f7b62f8914154bcb920b5
SHA512

3ebf597f809fe5e61c0be1307739b49127fc67e57bb0a0502e614c0bf06f1845f575324a5d4993786da17f2130f4da23f2a4ab6615e9052b708ebe09ff1e5569
SSDEEP

768:VX3D71oGc1FRVp74R/HesBKh0p29SgR2B:VHD71IPkFZKhG29j2B

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

vivo00007.no-ip.biz:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Targets

- Target
  
  be522b3b527e3a969ce3150c8def6fa91d517140e77f7b62f8914154bcb920b5
- Size
  
  29KB
- MD5
  
  6df7834b15218a8b3c3777ca7c085980
- SHA1
  
  a074a0f43a29de95c0c56693689943f123771a7f
- SHA256
  
  be522b3b527e3a969ce3150c8def6fa91d517140e77f7b62f8914154bcb920b5
- SHA512
  
  3ebf597f809fe5e61c0be1307739b49127fc67e57bb0a0502e614c0bf06f1845f575324a5d4993786da17f2130f4da23f2a4ab6615e9052b708ebe09ff1e5569
- SSDEEP
  
  768:VX3D71oGc1FRVp74R/HesBKh0p29SgR2B:VHD71IPkFZKhG29j2B
Score

10^/10

njrat hacked evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedevasiontrojan

behavioral2

njrathackedevasiontrojan