njrat | 605036e8b9ea6b9a0d0560300c63b69b8fd5532f62df3e09a5e82c00b16d7d8a | Triage

Sharing

General

Target

605036e8b9ea6b9a0d0560300c63b69b8fd5532f62df3e09a5e82c00b16d7d8a
Size

443KB
Sample

221128-wdtzrahd3y
MD5

61d8305b0f3144a90211c6ec2983a126
SHA1

5d5265f3335350e8d1da5d4e8d78826bc19e7781
SHA256

605036e8b9ea6b9a0d0560300c63b69b8fd5532f62df3e09a5e82c00b16d7d8a
SHA512

f0d4f38ecbba8fd0a6f8297a8866a853721ad6fdcee4a3e228d6fd3f7c52d4a7b3478d666c1eb955793cfd6d259c01ad006e98080690466c993d1a30da8e23dd
SSDEEP

6144:YITAbgaibD9Ll7oNbdyqR/QPCbaBepbVcOqOEMXA+zU7om+JN8qmP7c4H:aDIBlkjB1FbaBVNkJN8Tc4

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  605036e8b9ea6b9a0d0560300c63b69b8fd5532f62df3e09a5e82c00b16d7d8a
- Size
  
  443KB
- MD5
  
  61d8305b0f3144a90211c6ec2983a126
- SHA1
  
  5d5265f3335350e8d1da5d4e8d78826bc19e7781
- SHA256
  
  605036e8b9ea6b9a0d0560300c63b69b8fd5532f62df3e09a5e82c00b16d7d8a
- SHA512
  
  f0d4f38ecbba8fd0a6f8297a8866a853721ad6fdcee4a3e228d6fd3f7c52d4a7b3478d666c1eb955793cfd6d259c01ad006e98080690466c993d1a30da8e23dd
- SSDEEP
  
  6144:YITAbgaibD9Ll7oNbdyqR/QPCbaBepbVcOqOEMXA+zU7om+JN8qmP7c4H:aDIBlkjB1FbaBVNkJN8Tc4
Score

10^/10

evasion persistence njrat trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

njratevasionpersistencetrojan