njrat | bb7d4f537d08dcd28fa51ecee81a411da0154da59d1d8b06840577384d3acbdb | Triage

Sharing

General

Target

28fe4acd97e6e3992f0e3a3f265682b0_NeikiAnalytics.exe
Size

23KB
Sample

240525-16671ada25
MD5

28fe4acd97e6e3992f0e3a3f265682b0
SHA1

787eca84751d3c4b90dfe14ef61c9bd51de7497d
SHA256

bb7d4f537d08dcd28fa51ecee81a411da0154da59d1d8b06840577384d3acbdb
SHA512

a67abfdba3a908c575215d6fdb198ccbffeb0a579c8b7f2df44395d907d7452130c58f3e19e8475cd3716878650141b8650e34eb6594cd3c85f46c68ec8dd5ec
SSDEEP

384:wQ+ILgIbOprgPsUOSU0kB1kd6dg7GYh/JomRvR6JZlbw8hqIusZzZy0:7LL6MVU0NRpcnu4

Score

10^/10

njrat jjj evasion trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

jjj

C2

youri.mooo.com:1605

Mutex

e936a10f968ac948cd351c9629dbd36d

Attributes

reg_key
e936a10f968ac948cd351c9629dbd36d
splitter
|'|'|

Targets

- Target
  
  28fe4acd97e6e3992f0e3a3f265682b0_NeikiAnalytics.exe
- Size
  
  23KB
- MD5
  
  28fe4acd97e6e3992f0e3a3f265682b0
- SHA1
  
  787eca84751d3c4b90dfe14ef61c9bd51de7497d
- SHA256
  
  bb7d4f537d08dcd28fa51ecee81a411da0154da59d1d8b06840577384d3acbdb
- SHA512
  
  a67abfdba3a908c575215d6fdb198ccbffeb0a579c8b7f2df44395d907d7452130c58f3e19e8475cd3716878650141b8650e34eb6594cd3c85f46c68ec8dd5ec
- SSDEEP
  
  384:wQ+ILgIbOprgPsUOSU0kB1kd6dg7GYh/JomRvR6JZlbw8hqIusZzZy0:7LL6MVU0NRpcnu4
Score

10^/10

njrat evasion trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratevasiontrojan

behavioral2

njratevasiontrojan