njrat | 4ac1221a5f9d953361d8829f4731abf8083f893d89657226af68a95a81dfd54f | Triage

Sharing

General

Target

4ac1221a5f9d953361d8829f4731abf8083f893d89657226af68a95a81dfd54f
Size

31KB
Sample

221125-ksjxjsef25
MD5

9523df2bb382332fe5c90937fe086f8e
SHA1

067c730ef91289d650f0feb1c64ac7055eb8f876
SHA256

4ac1221a5f9d953361d8829f4731abf8083f893d89657226af68a95a81dfd54f
SHA512

756b1d19e93ae04f367802c92912921d064b2e831d7de5c7e26fe5caed2a4459597b1f909c2e629c05f8509c2185cd01fd0519ddc6bb1a32559059a84922ccf1
SSDEEP

768:NzMXZwpJbb2zxxO5oaqHhisfvagQmIDUu0tiNqj:CkKZisrQVkZj

Score

10^/10

njrat mybot evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

C2

217.118.79.35:6522

Mutex

2416b43a8b23bf20c2bc9bda2b6d87a8

Attributes

reg_key
2416b43a8b23bf20c2bc9bda2b6d87a8
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  4ac1221a5f9d953361d8829f4731abf8083f893d89657226af68a95a81dfd54f
- Size
  
  31KB
- MD5
  
  9523df2bb382332fe5c90937fe086f8e
- SHA1
  
  067c730ef91289d650f0feb1c64ac7055eb8f876
- SHA256
  
  4ac1221a5f9d953361d8829f4731abf8083f893d89657226af68a95a81dfd54f
- SHA512
  
  756b1d19e93ae04f367802c92912921d064b2e831d7de5c7e26fe5caed2a4459597b1f909c2e629c05f8509c2185cd01fd0519ddc6bb1a32559059a84922ccf1
- SSDEEP
  
  768:NzMXZwpJbb2zxxO5oaqHhisfvagQmIDUu0tiNqj:CkKZisrQVkZj
Score

10^/10

evasion persistence njrat trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

njratevasionpersistencetrojan