njrat | 3ae1ad6d75c07b757e298ba79acbe15f823bf3ed00d357c057dfb3378ace6b2f | Triage

Sharing

General

Target

3ae1ad6d75c07b757e298ba79acbe15f823bf3ed00d357c057dfb3378ace6b2f
Size

205KB
Sample

221125-c6fs2sac3s
MD5

217c37a9830fd04892a495561d3a7f72
SHA1

9fac66fccdc708242052aeea1c398b9cb8440d2a
SHA256

3ae1ad6d75c07b757e298ba79acbe15f823bf3ed00d357c057dfb3378ace6b2f
SHA512

9e47986c838cb484a1e0201d2679c6d7d4434ed3ce0e633116dd0fd5eb27ce850a2355ea46026f81b47c104f584c5dc6f442a194e84be9ea403ddeac5e790f77
SSDEEP

3072:crkmYSqvuzcqGhFHmhNOKd6zwkwxUwHfy1r:GYPmcFmhswkwxUj

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  3ae1ad6d75c07b757e298ba79acbe15f823bf3ed00d357c057dfb3378ace6b2f
- Size
  
  205KB
- MD5
  
  217c37a9830fd04892a495561d3a7f72
- SHA1
  
  9fac66fccdc708242052aeea1c398b9cb8440d2a
- SHA256
  
  3ae1ad6d75c07b757e298ba79acbe15f823bf3ed00d357c057dfb3378ace6b2f
- SHA512
  
  9e47986c838cb484a1e0201d2679c6d7d4434ed3ce0e633116dd0fd5eb27ce850a2355ea46026f81b47c104f584c5dc6f442a194e84be9ea403ddeac5e790f77
- SSDEEP
  
  3072:crkmYSqvuzcqGhFHmhNOKd6zwkwxUwHfy1r:GYPmcFmhswkwxUj
Score

10^/10

evasion persistence njrat trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

njratevasionpersistencetrojan