njrat | 564d4df84ffc6b065f1247eb516f633d98cfe93fe7a165571d185abdb27b75f1 | Triage

Sharing

General

Target

564d4df84ffc6b065f1247eb516f633d98cfe93fe7a165571d185abdb27b75f1
Size

43KB
Sample

221130-xt5xmaag3w
MD5

3c495c25592f2fc208bd20a556b33f70
SHA1

8b1bf2db8062852ad7666104f06f15ce9fbf2349
SHA256

564d4df84ffc6b065f1247eb516f633d98cfe93fe7a165571d185abdb27b75f1
SHA512

15b1b8b56a65b885effe37dd7c09476735a653b5b30b99d372f4cd1bf8c5887ba73fc788a404545a9cafa8b4d4340d23092cd88919b0da00a205158a829daf52
SSDEEP

384:eZyEvHn1iDcsyEqtBfkEGCOEhGyOEtzcIij+ZsNO3PlpJKkkjh/TzF7pWno/greT:kXHnU4pEqtNkE5SyZuXQ/oR3+L

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

Njrat 0.7 Golden By Hassan Amiri

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

Windows Update

Attributes

reg_key
Windows Update
splitter
|Hassan|

Targets

- Target
  
  564d4df84ffc6b065f1247eb516f633d98cfe93fe7a165571d185abdb27b75f1
- Size
  
  43KB
- MD5
  
  3c495c25592f2fc208bd20a556b33f70
- SHA1
  
  8b1bf2db8062852ad7666104f06f15ce9fbf2349
- SHA256
  
  564d4df84ffc6b065f1247eb516f633d98cfe93fe7a165571d185abdb27b75f1
- SHA512
  
  15b1b8b56a65b885effe37dd7c09476735a653b5b30b99d372f4cd1bf8c5887ba73fc788a404545a9cafa8b4d4340d23092cd88919b0da00a205158a829daf52
- SSDEEP
  
  384:eZyEvHn1iDcsyEqtBfkEGCOEhGyOEtzcIij+ZsNO3PlpJKkkjh/TzF7pWno/greT:kXHnU4pEqtNkE5SyZuXQ/oR3+L
Score

10^/10

njrat hacked persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedpersistencetrojan

behavioral2

njrathackedpersistencetrojan