njrat | 56f435a5987f429df40365c3fc9e17443e7a79a003d57d29b4b8f4396bf8c22b | Triage

Sharing

Copy URL Twitter E-mail

General

Target

97315a68b07a037396f793482dcb17f0
Size

1.3MB
Sample

240212-p3284adg5t
MD5

97315a68b07a037396f793482dcb17f0
SHA1

dfa2c6932c334883995ebdcdb2ffaddb65264f60
SHA256

56f435a5987f429df40365c3fc9e17443e7a79a003d57d29b4b8f4396bf8c22b
SHA512

1059faac37638ee2f5111468b9a65659f24acb6c0f8dcc358eb89c884cc567ddd97c6bad2fac3c619651afc1b234b82533390d426800482f26b10d5335af8ef3
SSDEEP

24576:2nsJ39LyjbJkQFMhmC+6GD9PDWHSb4NhfkbRPzeZBOBZ6ielDz8:2nsHyjtk2MYC5GDY84TOEuBkhNz8

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  97315a68b07a037396f793482dcb17f0
- Size
  
  1.3MB
- MD5
  
  97315a68b07a037396f793482dcb17f0
- SHA1
  
  dfa2c6932c334883995ebdcdb2ffaddb65264f60
- SHA256
  
  56f435a5987f429df40365c3fc9e17443e7a79a003d57d29b4b8f4396bf8c22b
- SHA512
  
  1059faac37638ee2f5111468b9a65659f24acb6c0f8dcc358eb89c884cc567ddd97c6bad2fac3c619651afc1b234b82533390d426800482f26b10d5335af8ef3
- SSDEEP
  
  24576:2nsJ39LyjbJkQFMhmC+6GD9PDWHSb4NhfkbRPzeZBOBZ6ielDz8:2nsHyjtk2MYC5GDY84TOEuBkhNz8
Score

10^/10

njrat evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratevasionpersistencetrojan

behavioral2

njratevasionpersistencetrojan