njrat | 17844684cadd484df2d647bf7fdcaa0279964b619d11cf74fd8d10132dba9677 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

e8c6f27128bd59e091f8e04449ca0790_NEIKI
Size

292KB
Sample

240509-em9m5ace73
MD5

e8c6f27128bd59e091f8e04449ca0790
SHA1

73662d569f73b19edc433681adeae358cdaf8fd8
SHA256

17844684cadd484df2d647bf7fdcaa0279964b619d11cf74fd8d10132dba9677
SHA512

b246838d0e76adb78b54aee54f86c34049d8233dc3e13b0eadde92d49216156ff7e4c22c5287f182328ec739843ce2eaf3a29975775591a04252f0f5c2819d16
SSDEEP

6144:yJ3c52e98+r6zMhZcL91Ouq7/oh+S7q1A8:yJKzFOQhOZMoFS

Score

10^/10

njrat evasion trojan

Malware Config

Targets

- Target
  
  e8c6f27128bd59e091f8e04449ca0790_NEIKI
- Size
  
  292KB
- MD5
  
  e8c6f27128bd59e091f8e04449ca0790
- SHA1
  
  73662d569f73b19edc433681adeae358cdaf8fd8
- SHA256
  
  17844684cadd484df2d647bf7fdcaa0279964b619d11cf74fd8d10132dba9677
- SHA512
  
  b246838d0e76adb78b54aee54f86c34049d8233dc3e13b0eadde92d49216156ff7e4c22c5287f182328ec739843ce2eaf3a29975775591a04252f0f5c2819d16
- SSDEEP
  
  6144:yJ3c52e98+r6zMhZcL91Ouq7/oh+S7q1A8:yJKzFOQhOZMoFS
Score

10^/10

njrat evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratevasiontrojan

behavioral2

njratevasiontrojan