njrat | e456dd25db07bcd5b9fdabfca9124d964d2cc4c2ea1826ceeb380b45c2208068 | Triage

Sharing

General

Target

Client.exe
Size

156KB
Sample

240217-trcaragf2w
MD5

66fe5a1d3958bdc41af36b742f5b0116
SHA1

976487aabbc04e030023ee72e455be1d48da4dfc
SHA256

e456dd25db07bcd5b9fdabfca9124d964d2cc4c2ea1826ceeb380b45c2208068
SHA512

a1018ed48e3b622c514b1636693d378941cb99e23054dbd69b2939cb928ee6b807e39d44d7bcc721e6bb1a15599931a3df60d203992de5d65a0d2c038a3f6d3f
SSDEEP

3072:k96q4hqGnhr1k3k+6pskWuHxl23eHnE07L31TOAM8J:ky1k0lppjRlxHn9TO

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  Client.exe
- Size
  
  156KB
- MD5
  
  66fe5a1d3958bdc41af36b742f5b0116
- SHA1
  
  976487aabbc04e030023ee72e455be1d48da4dfc
- SHA256
  
  e456dd25db07bcd5b9fdabfca9124d964d2cc4c2ea1826ceeb380b45c2208068
- SHA512
  
  a1018ed48e3b622c514b1636693d378941cb99e23054dbd69b2939cb928ee6b807e39d44d7bcc721e6bb1a15599931a3df60d203992de5d65a0d2c038a3f6d3f
- SSDEEP
  
  3072:k96q4hqGnhr1k3k+6pskWuHxl23eHnE07L31TOAM8J:ky1k0lppjRlxHn9TO
Score

10^/10

njrat evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratevasionpersistencetrojan