njrat | c56f7b994707861555b133c1826ddf02745007d10b457cf50172a170f5d933f3 | Triage

Sharing

General

Target

08b26b1bd71c6db9358c52230f0a87e2.exe
Size

23KB
Sample

230608-txzm8sgg69
MD5

08b26b1bd71c6db9358c52230f0a87e2
SHA1

46b37b3294362c6039316d94096c8bb8d9efec07
SHA256

c56f7b994707861555b133c1826ddf02745007d10b457cf50172a170f5d933f3
SHA512

9169a55960eacba3122033543e30e731668fd0456b031d779fdf499dd5e51e630a10d2fceb341b72bf782c23101cf38f95790271d30fc3a9af4f7d62b164cd85
SSDEEP

384:FXc68yCasVKDh3OQyNpsQ1im/VjJs+PyR46vg5J++p57nhmRvR6JZlbw8hqIusZ6:FD873Kt+QesGN/VjZPQRpcnuL

Score

10^/10

njrat hacked by code wc evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HACKED BY CODE WC

C2

laczin.duckdns.org:1177

Mutex

cc9fd5186c368372a70d5ebb96c720c0

Attributes

reg_key
cc9fd5186c368372a70d5ebb96c720c0
splitter
|'|'|

Targets

- Target
  
  08b26b1bd71c6db9358c52230f0a87e2.exe
- Size
  
  23KB
- MD5
  
  08b26b1bd71c6db9358c52230f0a87e2
- SHA1
  
  46b37b3294362c6039316d94096c8bb8d9efec07
- SHA256
  
  c56f7b994707861555b133c1826ddf02745007d10b457cf50172a170f5d933f3
- SHA512
  
  9169a55960eacba3122033543e30e731668fd0456b031d779fdf499dd5e51e630a10d2fceb341b72bf782c23101cf38f95790271d30fc3a9af4f7d62b164cd85
- SSDEEP
  
  384:FXc68yCasVKDh3OQyNpsQ1im/VjJs+PyR46vg5J++p57nhmRvR6JZlbw8hqIusZ6:FD873Kt+QesGN/VjZPQRpcnuL
Score

10^/10

evasion persistence njrat trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

hacked by code wcnjrat

behavioral1

evasionpersistence

behavioral2

njratevasionpersistencetrojan