njrat | f2a62fb8daca9f557351d98508d973222e9b8cd32f8777d5bdb51718361ff2f2 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

0532b10bba03e7dd5671ab51015b204a_JaffaCakes118
Size

481KB
Sample

240328-pa16bshh39
MD5

0532b10bba03e7dd5671ab51015b204a
SHA1

02f9e72baf980fd9438336bce4e18c69c1ccfbb3
SHA256

f2a62fb8daca9f557351d98508d973222e9b8cd32f8777d5bdb51718361ff2f2
SHA512

6351700437ff5feeda5b3a3101ebf27eafdfa4d8880761ec7d199931f73a741ad4519e4643ceaa1be7b0a84403510c4e8678a2c4e2f5e7cfffd32364256d1c88
SSDEEP

3072:EO9BEZ57xfUFKLQBO3kywtWDc5Cfo5+2F62W/8NyzohGX8F67rTsV6/ZRETJtHw4:99OEHLD

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  0532b10bba03e7dd5671ab51015b204a_JaffaCakes118
- Size
  
  481KB
- MD5
  
  0532b10bba03e7dd5671ab51015b204a
- SHA1
  
  02f9e72baf980fd9438336bce4e18c69c1ccfbb3
- SHA256
  
  f2a62fb8daca9f557351d98508d973222e9b8cd32f8777d5bdb51718361ff2f2
- SHA512
  
  6351700437ff5feeda5b3a3101ebf27eafdfa4d8880761ec7d199931f73a741ad4519e4643ceaa1be7b0a84403510c4e8678a2c4e2f5e7cfffd32364256d1c88
- SSDEEP
  
  3072:EO9BEZ57xfUFKLQBO3kywtWDc5Cfo5+2F62W/8NyzohGX8F67rTsV6/ZRETJtHw4:99OEHLD
Score

10^/10

njrat trojan evasion persistence
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

njratevasionpersistencetrojan