njrat | e0204b304c1e6511a56174db8890d515142e7edb8687240c4469691cdbbcf923 | Triage

Sharing

General

Target

e0204b304c1e6511a56174db8890d515142e7edb8687240c4469691cdbbcf923
Size

28KB
Sample

221203-w2j5fshd3t
MD5

4b0a7a117de982ddc126a56c43015f0e
SHA1

7b89a8e00765edd2ce0e5ab1c1f54477440ff0dc
SHA256

e0204b304c1e6511a56174db8890d515142e7edb8687240c4469691cdbbcf923
SHA512

19feb850c04f7813368621bb5d87dc7240004ed153f3485503f7a0c95fa1367065625aee03adaa72d7fa4b969fff4a0ae9113c69a6c8833e4ab6e72985305400
SSDEEP

384:xqGwWqbEExKV9nRmL2WXD5w9KzJ2Dz0oZd87tagjEnY0LE2iWGpbiNrxwYRzjmM8:BRZc5w9WCAG8Ragv0LEWyb6zr

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  e0204b304c1e6511a56174db8890d515142e7edb8687240c4469691cdbbcf923
- Size
  
  28KB
- MD5
  
  4b0a7a117de982ddc126a56c43015f0e
- SHA1
  
  7b89a8e00765edd2ce0e5ab1c1f54477440ff0dc
- SHA256
  
  e0204b304c1e6511a56174db8890d515142e7edb8687240c4469691cdbbcf923
- SHA512
  
  19feb850c04f7813368621bb5d87dc7240004ed153f3485503f7a0c95fa1367065625aee03adaa72d7fa4b969fff4a0ae9113c69a6c8833e4ab6e72985305400
- SSDEEP
  
  384:xqGwWqbEExKV9nRmL2WXD5w9KzJ2Dz0oZd87tagjEnY0LE2iWGpbiNrxwYRzjmM8:BRZc5w9WCAG8Ragv0LEWyb6zr
Score

10^/10

njrat evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njratevasionpersistencetrojan

behavioral2

njratevasionpersistencetrojan