njrat | d94cab204804e6bcbd70f2ef71ad57cf01f9d15d16ed2c73efb46d3725f7a264 | Triage

Sharing

General

Target

d94cab204804e6bcbd70f2ef71ad57cf01f9d15d16ed2c73efb46d3725f7a264
Size

112KB
Sample

221125-hrtdgshe93
MD5

3119a3e493cf879b4fb602e14e86f043
SHA1

ada806fbb5f0d8705fdc51b483b17b854131ddfb
SHA256

d94cab204804e6bcbd70f2ef71ad57cf01f9d15d16ed2c73efb46d3725f7a264
SHA512

15ba4326731121e4f56e259a29210be6a8537839439a4f6b57e73d6ac369a6dfbe1e6027406532e1ca430381542fd5f572342bb1ad905c0f3d5f4bc3597ceaf8
SSDEEP

1536:PInhq8KPbgshva5udpsr3Xgr9p8Xzmv2YhAz3:r8KPbgwva5mpE3XgUQo

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  d94cab204804e6bcbd70f2ef71ad57cf01f9d15d16ed2c73efb46d3725f7a264
- Size
  
  112KB
- MD5
  
  3119a3e493cf879b4fb602e14e86f043
- SHA1
  
  ada806fbb5f0d8705fdc51b483b17b854131ddfb
- SHA256
  
  d94cab204804e6bcbd70f2ef71ad57cf01f9d15d16ed2c73efb46d3725f7a264
- SHA512
  
  15ba4326731121e4f56e259a29210be6a8537839439a4f6b57e73d6ac369a6dfbe1e6027406532e1ca430381542fd5f572342bb1ad905c0f3d5f4bc3597ceaf8
- SSDEEP
  
  1536:PInhq8KPbgshva5udpsr3Xgr9p8Xzmv2YhAz3:r8KPbgwva5mpE3XgUQo
Score

10^/10

njrat evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njratevasionpersistencetrojan

behavioral2

njratevasionpersistencetrojan