njrat | 8ee097f4c5464560963f1d35992457cea0200de7d1d875a407bca1f8c968d65a | Triage

Sharing

General

Target

8ee097f4c5464560963f1d35992457cea0200de7d1d875a407bca1f8c968d65a
Size

23KB
Sample

221126-n7llgafa8t
MD5

51b86780ff98433c0feec90a74b59012
SHA1

53284cef98045715efba7c48bdc1d3beaf1bd6bc
SHA256

8ee097f4c5464560963f1d35992457cea0200de7d1d875a407bca1f8c968d65a
SHA512

b4d7a2f302230727a162513a352f15704733ce171d17c0c6aea68fe123275f53af7e1cd31e82b49f06343dbdf55a485c9cd887c89eff8ff58cf9e417fda424bc
SSDEEP

384:7slUlEvOEJ8xWwYJOMiOBZEdj1567gtwi5HhbQmRvR6JZlbw8hqIusZzZII:8eEvwIlLMRpcnuu

Score

10^/10

njrat bot evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Bot

C2

smuktnet.ddns.net:5552

Mutex

a9baaa8bc4cfb3b3471539748fd978f9

Attributes

reg_key
a9baaa8bc4cfb3b3471539748fd978f9
splitter
|'|'|

Targets

- Target
  
  8ee097f4c5464560963f1d35992457cea0200de7d1d875a407bca1f8c968d65a
- Size
  
  23KB
- MD5
  
  51b86780ff98433c0feec90a74b59012
- SHA1
  
  53284cef98045715efba7c48bdc1d3beaf1bd6bc
- SHA256
  
  8ee097f4c5464560963f1d35992457cea0200de7d1d875a407bca1f8c968d65a
- SHA512
  
  b4d7a2f302230727a162513a352f15704733ce171d17c0c6aea68fe123275f53af7e1cd31e82b49f06343dbdf55a485c9cd887c89eff8ff58cf9e417fda424bc
- SSDEEP
  
  384:7slUlEvOEJ8xWwYJOMiOBZEdj1567gtwi5HhbQmRvR6JZlbw8hqIusZzZII:8eEvwIlLMRpcnuu
Score

10^/10

evasion persistence njrat trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

njratevasionpersistencetrojan