njrat | 9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5 | Triage

Sharing

General

Target

9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5
Size

700KB
Sample

221125-kqa7maed94
MD5

a9439adb62fd0ccb362f53f2b5c5fc83
SHA1

82970293fbb728e29f3a95b86ac1d843eb4c1a0b
SHA256

9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5
SHA512

d22cbdfea9d6e27c06fa3a131db6c355b97ff6902b7704b57c0e876e93d4da45a2ab5090c89dc08ab14b616a230fd73d3aac65b9a051907aed795f1e9bcb08bb
SSDEEP

12288:judvGqfXWossOS6v5rxO/thd289rKvl+mUoJXpCOxDpBnm7HZZG75gvI8pb2SsIg:judTf1slz5x0fPKvl+PSXpCOxDHn6ZYT

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5
- Size
  
  700KB
- MD5
  
  a9439adb62fd0ccb362f53f2b5c5fc83
- SHA1
  
  82970293fbb728e29f3a95b86ac1d843eb4c1a0b
- SHA256
  
  9a980911c8fc917eae2f2af5e193a939e72efa8c97471243cf674ec1e60c61b5
- SHA512
  
  d22cbdfea9d6e27c06fa3a131db6c355b97ff6902b7704b57c0e876e93d4da45a2ab5090c89dc08ab14b616a230fd73d3aac65b9a051907aed795f1e9bcb08bb
- SSDEEP
  
  12288:judvGqfXWossOS6v5rxO/thd289rKvl+mUoJXpCOxDpBnm7HZZG75gvI8pb2SsIg:judTf1slz5x0fPKvl+PSXpCOxDHn6ZYT
Score

10^/10

evasion persistence njrat trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

njratevasionpersistencetrojan