njrat | e3125350e7b146cdf13186e9445a7fbea6eb844ed6b2c1365de22111e3faa1e4 | Triage

Sharing

General

Target

E3125350E7B146CDF13186E9445A7FBEA6EB844ED6B2C.exe
Size

31KB
Sample

230702-t9yxgaca82
MD5

11ac1b109edb30c424b20c617beb6916
SHA1

03ae0d139376f7e3b0d1ebb04f8db94aeb09ee36
SHA256

e3125350e7b146cdf13186e9445a7fbea6eb844ed6b2c1365de22111e3faa1e4
SHA512

d263fbf5eea1283506d3524a7d343ff60ca537cdf149a00017daa348aa2804e7f1d1016fee44f76d8b452638e3e76b214930dda41b8c5b9a65dc176bd219be72
SSDEEP

768:gmv4fqdzNB0zx/6LmzmnAXdvAFQmIDUu0tirLj:a6KjpAQVk+j

Score

10^/10

njrat mybot evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

C2

7.tcp.eu.ngrok.io:13920

Mutex

c4a09cd484fd6f470d5ada5572d6d011

Attributes

reg_key
c4a09cd484fd6f470d5ada5572d6d011
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  E3125350E7B146CDF13186E9445A7FBEA6EB844ED6B2C.exe
- Size
  
  31KB
- MD5
  
  11ac1b109edb30c424b20c617beb6916
- SHA1
  
  03ae0d139376f7e3b0d1ebb04f8db94aeb09ee36
- SHA256
  
  e3125350e7b146cdf13186e9445a7fbea6eb844ed6b2c1365de22111e3faa1e4
- SHA512
  
  d263fbf5eea1283506d3524a7d343ff60ca537cdf149a00017daa348aa2804e7f1d1016fee44f76d8b452638e3e76b214930dda41b8c5b9a65dc176bd219be72
- SSDEEP
  
  768:gmv4fqdzNB0zx/6LmzmnAXdvAFQmIDUu0tirLj:a6KjpAQVk+j
Score

10^/10

evasion persistence njrat trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

njratevasionpersistencetrojan