njrat | aebe14fe1dfbd89848f51831dc53f2e0df55908783959b57eec070c2a1ddc98c | Triage

Sharing

General

Target

aebe14fe1dfbd89848f51831dc53f2e0df55908783959b57eec070c2a1ddc98c
Size

383KB
Sample

221126-klkkhaab2x
MD5

ee67fdd8f9b5dffe1d0d123caf3032f7
SHA1

a8adc23fae4182ec697f0bf313e5f6a35a7fb938
SHA256

aebe14fe1dfbd89848f51831dc53f2e0df55908783959b57eec070c2a1ddc98c
SHA512

0b72f4eaec920a45672ec3463075adc9f92fcfb694694362fbdfb807b9e4af2222a06ac8c472ea5449e8d154b2e739f0e1867986236614336cd0b2351123a391
SSDEEP

6144:lvLnQs/GKl8uHsdcPZBKsthXOb5klzPYbT9l4:MUBRXOb5klzPYbT9l

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  aebe14fe1dfbd89848f51831dc53f2e0df55908783959b57eec070c2a1ddc98c
- Size
  
  383KB
- MD5
  
  ee67fdd8f9b5dffe1d0d123caf3032f7
- SHA1
  
  a8adc23fae4182ec697f0bf313e5f6a35a7fb938
- SHA256
  
  aebe14fe1dfbd89848f51831dc53f2e0df55908783959b57eec070c2a1ddc98c
- SHA512
  
  0b72f4eaec920a45672ec3463075adc9f92fcfb694694362fbdfb807b9e4af2222a06ac8c472ea5449e8d154b2e739f0e1867986236614336cd0b2351123a391
- SSDEEP
  
  6144:lvLnQs/GKl8uHsdcPZBKsthXOb5klzPYbT9l4:MUBRXOb5klzPYbT9l
Score

10^/10

evasion persistence njrat trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

njratevasionpersistencetrojan