njrat | 3d272e26f5ef378082fd12a9ad22ff4189003b5ab6062781085a7bead5fc7ffe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

3d272e26f5ef378082fd12a9ad22ff4189003b5ab6062781085a7bead5fc7ffe
Size

142KB
Sample

221125-vkt3nafa8z
MD5

f02e991e47f748452b1890c851851502
SHA1

296030748dadc40b4ecea6ff12f21de32dbc1ba7
SHA256

3d272e26f5ef378082fd12a9ad22ff4189003b5ab6062781085a7bead5fc7ffe
SHA512

3e04ccbbb5ee305835f045ca21253cb74b36b93e97ee1424d7689d88a22ff6fcf3d05c714e6412785f50f9a8920dfca8e6e87a6e1dbfe1d6482bbc20499cd0f4
SSDEEP

1536:YTTgK2ohN4WgdRKFsssssiFgmFqxDZCAwsssssv2sssEsaM+mgYjgXA3AN5cZFq7:Y/gK34RRKrdsxlUsHq0w0EH

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  3d272e26f5ef378082fd12a9ad22ff4189003b5ab6062781085a7bead5fc7ffe
- Size
  
  142KB
- MD5
  
  f02e991e47f748452b1890c851851502
- SHA1
  
  296030748dadc40b4ecea6ff12f21de32dbc1ba7
- SHA256
  
  3d272e26f5ef378082fd12a9ad22ff4189003b5ab6062781085a7bead5fc7ffe
- SHA512
  
  3e04ccbbb5ee305835f045ca21253cb74b36b93e97ee1424d7689d88a22ff6fcf3d05c714e6412785f50f9a8920dfca8e6e87a6e1dbfe1d6482bbc20499cd0f4
- SSDEEP
  
  1536:YTTgK2ohN4WgdRKFsssssiFgmFqxDZCAwsssssv2sssEsaM+mgYjgXA3AN5cZFq7:Y/gK34RRKrdsxlUsHq0w0EH
Score

10^/10

njrat evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

njratevasionpersistencetrojan