njrat | 9957b4a7b35663a3f3d10eb32cbf64a84a9eef93a913d55e579acad935a74eec | Triage

Sharing

General

Target

Quotation List_0348.r00
Size

2KB
Sample

221104-v5vjxshcd9
MD5

f856d00a380c5822f5dbb23ad84d5d34
SHA1

db7c8fb4f42ba1d6d7765fa51087d1dbe3d45a95
SHA256

9957b4a7b35663a3f3d10eb32cbf64a84a9eef93a913d55e579acad935a74eec
SHA512

3e9f029a4343dfee53dff0ce9280d0915855b839721fb325e8b9558c55f2644e433887c85bb7097f49178c864f6a967a07546bded7b779a47e71d698ae0e8321

Score

10^/10

njrat update persistence trojan

Malware Config

Extracted

Family

njrat

Version

v2.0

Botnet

update

C2

money2022.ddns.net:8080

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Targets

- Target
  
  Quotation List_0348.exe
- Size
  
  6KB
- MD5
  
  53e70bf3a2964e9c086d8ea3ac0daddf
- SHA1
  
  82c8534e7cf0cf7d899d5871d0da82ba9c875f3b
- SHA256
  
  246e869353e3d90c8aef21611cdfa29f32eaf84c07382ceaa0b251818213c541
- SHA512
  
  74c3f2d7f4ad771690dba6ee0e6964aeb77aaed77bfc5d4e3ad3dc0104076a2085383272697247ec3191cafae87af437333f024323160f0af6714bf0663ead6b
- SSDEEP
  
  96:XVuqNek+1LnGPL5RT2SzLAEy/tnp347KVYzNt:wH1Lqh2SzLAEUNR4g6
Score

10^/10

njrat update persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Hidden Files and Directories

Privilege Escalation

Defense Evasion

Modify Registry

Hidden Files and Directories

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njratupdatepersistencetrojan

behavioral2

njratupdatepersistencetrojan