njrat | 839c9cd69a9b5168f40b8c222b35cd183520dc3323e5d51598c04a8c6b03f3c9 | Triage

Sharing

General

Target

839c9cd69a9b5168f40b8c222b35cd183520dc3323e5d51598c04a8c6b03f3c9
Size

23KB
Sample

221126-22wfdabg96
MD5

07f175882fcfb27f1ee32668d2a30fc1
SHA1

e50876dae588993fd29b14c5201fc695cb90da64
SHA256

839c9cd69a9b5168f40b8c222b35cd183520dc3323e5d51598c04a8c6b03f3c9
SHA512

4d17637a699a6097c55cf976fcda13ff56c4c6bf280dce420e0dd83d4c56b5da3f61d679af5068c52903c8e4682dbce0fe1459a393c0b3f63d1957a7bf875bbb
SSDEEP

384:QY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZbQ:/L2s+tRyRpcnuD

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

b99a7aae14ee0bf4b8e6b90ecd7a8198

Attributes

reg_key
b99a7aae14ee0bf4b8e6b90ecd7a8198
splitter
|'|'|

Targets

- Target
  
  839c9cd69a9b5168f40b8c222b35cd183520dc3323e5d51598c04a8c6b03f3c9
- Size
  
  23KB
- MD5
  
  07f175882fcfb27f1ee32668d2a30fc1
- SHA1
  
  e50876dae588993fd29b14c5201fc695cb90da64
- SHA256
  
  839c9cd69a9b5168f40b8c222b35cd183520dc3323e5d51598c04a8c6b03f3c9
- SHA512
  
  4d17637a699a6097c55cf976fcda13ff56c4c6bf280dce420e0dd83d4c56b5da3f61d679af5068c52903c8e4682dbce0fe1459a393c0b3f63d1957a7bf875bbb
- SSDEEP
  
  384:QY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZbQ:/L2s+tRyRpcnuD
Score

10^/10

njrat hacked evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedevasionpersistencetrojan

behavioral2