njrat | 2a359b10801a599ef45eff481440fade4752a748edd3ade77698bf73987002b9 | Triage

Sharing

General

Target

2a359b10801a599ef45eff481440fade4752a748edd3ade77698bf73987002b9
Size

22KB
Sample

221126-kmjplaab6s
MD5

80b2b69c2fdd36cdc86f0c09d051ba7b
SHA1

cf40ff0619e70d274e943f7f4f35f1fe0224b74a
SHA256

2a359b10801a599ef45eff481440fade4752a748edd3ade77698bf73987002b9
SHA512

585400f2db58956440c9ea28fa0dbbe0ac18f38824a035ab3c18191c063716c1f4174def7aac1f9a9e5bbb69e38324ba0cb8ec9e036ea2aee3ec1082a5b2b5ed
SSDEEP

384:5Y324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZOA:OL2s+tRyRpcnug

Score

10^/10

njrat hacked evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hbeebxooox.ddns.net:1177

Mutex

c483f2c06cec80dc7fbdca44b3c4a986

Attributes

reg_key
c483f2c06cec80dc7fbdca44b3c4a986
splitter
|'|'|

Targets

- Target
  
  2a359b10801a599ef45eff481440fade4752a748edd3ade77698bf73987002b9
- Size
  
  22KB
- MD5
  
  80b2b69c2fdd36cdc86f0c09d051ba7b
- SHA1
  
  cf40ff0619e70d274e943f7f4f35f1fe0224b74a
- SHA256
  
  2a359b10801a599ef45eff481440fade4752a748edd3ade77698bf73987002b9
- SHA512
  
  585400f2db58956440c9ea28fa0dbbe0ac18f38824a035ab3c18191c063716c1f4174def7aac1f9a9e5bbb69e38324ba0cb8ec9e036ea2aee3ec1082a5b2b5ed
- SSDEEP
  
  384:5Y324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZOA:OL2s+tRyRpcnug
Score

10^/10

evasion persistence njrat trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

njratevasionpersistencetrojan