njrat | af6e0a566847c9a86c3effca62657aa6fc6a2fe68882148a0a81b02fc3259641 | Triage

Sharing

General

Target

23c8c1a5b3b7a53e9c142b5fec2e977f_JaffaCakes118
Size

260KB
Sample

240508-h5c9esbd56
MD5

23c8c1a5b3b7a53e9c142b5fec2e977f
SHA1

b36440c5f7c3b365d4c0eec43e9597426d3553bb
SHA256

af6e0a566847c9a86c3effca62657aa6fc6a2fe68882148a0a81b02fc3259641
SHA512

7be453566b83c1bce02c569ad69bd0f0a33bac1a371401ae2be1d36e69b6390aad0da6ca830d8aaac5de1b759d531576bd3ed2fd959f1c71b71aa126f815ff06
SSDEEP

3072:FTkHhXapoK/jcUWCxIqLeynCu2TNAWgQ0WeiDUoTqI0DmMqOtlIZfWRJ8KIKA799:FTYXaVRW8d6iGZLX0YfilIr7t24

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  23c8c1a5b3b7a53e9c142b5fec2e977f_JaffaCakes118
- Size
  
  260KB
- MD5
  
  23c8c1a5b3b7a53e9c142b5fec2e977f
- SHA1
  
  b36440c5f7c3b365d4c0eec43e9597426d3553bb
- SHA256
  
  af6e0a566847c9a86c3effca62657aa6fc6a2fe68882148a0a81b02fc3259641
- SHA512
  
  7be453566b83c1bce02c569ad69bd0f0a33bac1a371401ae2be1d36e69b6390aad0da6ca830d8aaac5de1b759d531576bd3ed2fd959f1c71b71aa126f815ff06
- SSDEEP
  
  3072:FTkHhXapoK/jcUWCxIqLeynCu2TNAWgQ0WeiDUoTqI0DmMqOtlIZfWRJ8KIKA799:FTYXaVRW8d6iGZLX0YfilIr7t24
Score

10^/10

njrat evasion persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratevasionpersistencetrojan

behavioral2

njratevasionpersistencetrojan