njrat | 92c159bc0ccc5e0dc0dbfcd89567bb52fd8183b573f3d0e90098f0f870da56ae | Triage

Sharing

General

Target

Payload2023.exe
Size

27KB
Sample

230326-2wb5jsad44
MD5

b85cd29095492a2688686bb14c50cb2d
SHA1

4cd161ec7545478f87a405e09b6691cc6c4aa86a
SHA256

92c159bc0ccc5e0dc0dbfcd89567bb52fd8183b573f3d0e90098f0f870da56ae
SHA512

8544b7ee6203a65414222b4d0df318ce40ef033d41ffec879b15995608af36c7e948cdcd6c03f66b1e17696745913e795e23c1d3e54b7c3a5ffa47d40e1d312a
SSDEEP

384:TLIl2J1dJFKnO4YLJ5zeZsL4E7O4/ChZGPjdx4kM0AQk93vmhm7UMKmIEecKdbXs:3VJFPleeHU0A/vMHTi9bD

Score

10^/10

njrat hacked persistence trojan

Malware Config

Extracted

Family

njrat

Version

v4.0

Botnet

HacKed

C2

soon-lp.at.ply.gg:17209

Mutex

Windows

Attributes

reg_key
Windows
splitter
|-F-|

Targets

- Target
  
  Payload2023.exe
- Size
  
  27KB
- MD5
  
  b85cd29095492a2688686bb14c50cb2d
- SHA1
  
  4cd161ec7545478f87a405e09b6691cc6c4aa86a
- SHA256
  
  92c159bc0ccc5e0dc0dbfcd89567bb52fd8183b573f3d0e90098f0f870da56ae
- SHA512
  
  8544b7ee6203a65414222b4d0df318ce40ef033d41ffec879b15995608af36c7e948cdcd6c03f66b1e17696745913e795e23c1d3e54b7c3a5ffa47d40e1d312a
- SSDEEP
  
  384:TLIl2J1dJFKnO4YLJ5zeZsL4E7O4/ChZGPjdx4kM0AQk93vmhm7UMKmIEecKdbXs:3VJFPleeHU0A/vMHTi9bD
Score

10^/10

njrat hacked persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Hidden Files and Directories

Privilege Escalation

Defense Evasion

Modify Registry

Hidden Files and Directories

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

njrathackedpersistencetrojan