njrat | 02b521d5e6e067a04c04ec17e6b024cd14788c7df268540d8e68ee98023d9430 | Triage

Sharing

General

Target

Client.exe
Size

31KB
Sample

240319-y2zw1sed82
MD5

c681d81f57698fa19d01ca73f6bbcb1f
SHA1

4348315502f691f6e67827558c12e1dd411253b6
SHA256

02b521d5e6e067a04c04ec17e6b024cd14788c7df268540d8e68ee98023d9430
SHA512

a4472d4930f1c0e07003fa5218fd4bfd8aad65764e709706e0a7af0ac13df46271e1881e826543adfc7089d596d2baacd542ff16600e9080b669438c4b29c013
SSDEEP

768:IXJEpBZhjzOzx5+R4s/Hu56HdAbiTinvaTQmIDUu0tiT9j:XD6uukAbiT6oQVk8j

Score

10^/10

njrat mybot evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

C2

group-winy (1):9999

Mutex

26f2adeb0cdd6c070ef9f9ed18e8e9c0

Attributes

reg_key
26f2adeb0cdd6c070ef9f9ed18e8e9c0
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  Client.exe
- Size
  
  31KB
- MD5
  
  c681d81f57698fa19d01ca73f6bbcb1f
- SHA1
  
  4348315502f691f6e67827558c12e1dd411253b6
- SHA256
  
  02b521d5e6e067a04c04ec17e6b024cd14788c7df268540d8e68ee98023d9430
- SHA512
  
  a4472d4930f1c0e07003fa5218fd4bfd8aad65764e709706e0a7af0ac13df46271e1881e826543adfc7089d596d2baacd542ff16600e9080b669438c4b29c013
- SSDEEP
  
  768:IXJEpBZhjzOzx5+R4s/Hu56HdAbiTinvaTQmIDUu0tiT9j:XD6uukAbiT6oQVk8j
Score

10^/10

njrat evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1

njratevasiontrojan