njrat | 21f363df520e1b7a2d6e57adf4184e00b6a4b203d5ce23bc0d3e7827f4831308 | Triage

Sharing

General

Target

Lammer.exe
Size

23KB
Sample

231130-bnb7gaee9z
MD5

f7ec3d63b502817b80fd3dcf55490f51
SHA1

1497919717e785431989dafdc7fbfecfebce24fa
SHA256

21f363df520e1b7a2d6e57adf4184e00b6a4b203d5ce23bc0d3e7827f4831308
SHA512

80275c86efd7e9df3d1f6928d1a4a45d9b2b54ba3e42c1d76c4d72626afd99b30271b49071710492b5691765ab8799f9089dac1735940ead2fb5f61d07c31071
SSDEEP

384:NI2SUCoQ3XgUzwsGCw5zSEZJgA6hgHpFChrV1mRvR6JZlbw8hqIusZzZiJ:yNnzdwk8Rpcnu9

Score

10^/10

njrat lammer evasion persistence trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Lammer

C2

88:1177

Mutex

037e0025c7a22a528848d2878222da5d

Attributes

reg_key
037e0025c7a22a528848d2878222da5d
splitter
|'|'|

Targets

- Target
  
  Lammer.exe
- Size
  
  23KB
- MD5
  
  f7ec3d63b502817b80fd3dcf55490f51
- SHA1
  
  1497919717e785431989dafdc7fbfecfebce24fa
- SHA256
  
  21f363df520e1b7a2d6e57adf4184e00b6a4b203d5ce23bc0d3e7827f4831308
- SHA512
  
  80275c86efd7e9df3d1f6928d1a4a45d9b2b54ba3e42c1d76c4d72626afd99b30271b49071710492b5691765ab8799f9089dac1735940ead2fb5f61d07c31071
- SSDEEP
  
  384:NI2SUCoQ3XgUzwsGCw5zSEZJgA6hgHpFChrV1mRvR6JZlbw8hqIusZzZiJ:yNnzdwk8Rpcnu9
Score

10^/10

njrat evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Create or Modify System Process

Windows Service

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

njratevasionpersistencetrojan