njrat | 6edcdbc6caa8df8929d340f22e32cce0c93080b1a2fdeb1018c4fc7da3db06b7 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

6edcdbc6caa8df8929d340f22e32cce0c93080b1a2fdeb1018c4fc7da3db06b7
Size

808KB
Sample

221029-av65raebek
MD5

a763b20d75bf1ea595e94b5fc8b84f48
SHA1

b26f41828e70c0b89f61ea1bd7e359a94393647c
SHA256

6edcdbc6caa8df8929d340f22e32cce0c93080b1a2fdeb1018c4fc7da3db06b7
SHA512

df7e0c890caaa3ac0df4a5372694b286c79c0062afd3c02d447f1e872b55f901bbe3a722c49314f6d1e4cd6056c915449e410885eb0bb148615c538a3452cb35
SSDEEP

12288:hV7JjCahIop+agUWsyCZR2iy9b3HniiiiiiiiirB:TJ2ahfzWIRZyhHK

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  6edcdbc6caa8df8929d340f22e32cce0c93080b1a2fdeb1018c4fc7da3db06b7
- Size
  
  808KB
- MD5
  
  a763b20d75bf1ea595e94b5fc8b84f48
- SHA1
  
  b26f41828e70c0b89f61ea1bd7e359a94393647c
- SHA256
  
  6edcdbc6caa8df8929d340f22e32cce0c93080b1a2fdeb1018c4fc7da3db06b7
- SHA512
  
  df7e0c890caaa3ac0df4a5372694b286c79c0062afd3c02d447f1e872b55f901bbe3a722c49314f6d1e4cd6056c915449e410885eb0bb148615c538a3452cb35
- SSDEEP
  
  12288:hV7JjCahIop+agUWsyCZR2iy9b3HniiiiiiiiirB:TJ2ahfzWIRZyhHK
Score

10^/10

njrat evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

njratevasionpersistencetrojan