njrat | 2f151fa4d9786e8a2ade35155e48067a746dff0df62cbceeaf63cf0ff0a1d255 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

gamma.exe
Size

37KB
Sample

240212-s1za7shd7s
MD5

b762e3c934d650a7533c44f49cbb0646
SHA1

0d7a5cc37253fc09940a6a15932e504b07287019
SHA256

2f151fa4d9786e8a2ade35155e48067a746dff0df62cbceeaf63cf0ff0a1d255
SHA512

d14c52e667f04edad954a584e0eb34cc06ef127526ce8c7c9af68870969f1dc1e109cabe9c037725bd706bf5294aacc61218cab92f6fc571712e61dcbcd3351f
SSDEEP

384:iAnTAKiwB4aJzN5BLiFI4yUvaF//R+4oJ69vrAF+rMRTyN/0L+EcoinblneHQM3C:Zn5NP5TUva1Il6hrM+rMRa8Nu52Wt

Score

10^/10

njrat hacked evasion trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

5.39.43.50:1610

Mutex

c08d47000bf19b95a3ed7202fe1dc0f1

Attributes

reg_key
c08d47000bf19b95a3ed7202fe1dc0f1
splitter
|'|'|

Targets

- Target
  
  gamma.exe
- Size
  
  37KB
- MD5
  
  b762e3c934d650a7533c44f49cbb0646
- SHA1
  
  0d7a5cc37253fc09940a6a15932e504b07287019
- SHA256
  
  2f151fa4d9786e8a2ade35155e48067a746dff0df62cbceeaf63cf0ff0a1d255
- SHA512
  
  d14c52e667f04edad954a584e0eb34cc06ef127526ce8c7c9af68870969f1dc1e109cabe9c037725bd706bf5294aacc61218cab92f6fc571712e61dcbcd3351f
- SSDEEP
  
  384:iAnTAKiwB4aJzN5BLiFI4yUvaF//R+4oJ69vrAF+rMRTyN/0L+EcoinblneHQM3C:Zn5NP5TUva1Il6hrM+rMRa8Nu52Wt
Score

10^/10

njrat hacked evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Remote System Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackedevasiontrojan