njrat | ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286 | Triage

Sharing

General

Target

ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286
Size

29KB
Sample

221003-trz2taedfm
MD5

42bafdfa039f7a0fc54d2cb7ec699ad0
SHA1

1ae11d9e6364f59185662111da19c8888e23d38e
SHA256

ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286
SHA512

b9327dbbd2cbc5c79353d9f9e436edb7162292297ecd59e3e6a0254c3ece1d8e9af5b6eba72150c7b4391c6b946979d39268f07428988d6dce7a408a4111158c
SSDEEP

768:KCu75oa4fu124AuhjXeJBKh0p29SgRvU5:O75CPAj8KhG29jv4

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

dmaarr.no.ip.info:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Targets

- Target
  
  ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286
- Size
  
  29KB
- MD5
  
  42bafdfa039f7a0fc54d2cb7ec699ad0
- SHA1
  
  1ae11d9e6364f59185662111da19c8888e23d38e
- SHA256
  
  ac88b8cb4a6f389a77fd6c6dde34ba8eb1ade2eeda78acedf4bb60efcc556286
- SHA512
  
  b9327dbbd2cbc5c79353d9f9e436edb7162292297ecd59e3e6a0254c3ece1d8e9af5b6eba72150c7b4391c6b946979d39268f07428988d6dce7a408a4111158c
- SSDEEP
  
  768:KCu75oa4fu124AuhjXeJBKh0p29SgRvU5:O75CPAj8KhG29jv4
Score

10^/10

njrat hacked trojan evasion
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedtrojan

behavioral2

njrathackedevasiontrojan