njrat | 68021ca2722cb5eadaed2cd5b9c46903d01077dad0ebafdcef2de6d9e0664d67 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

68021ca2722cb5eadaed2cd5b9c46903d01077dad0ebafdcef2de6d9e0664d67.exe
Size

23KB
Sample

240726-d54n6atgrk
MD5

3da0670c583abb45648e3f0c6ab5089e
SHA1

5ac7e03ff02e77a5dcb094165759ad8fcec72b88
SHA256

68021ca2722cb5eadaed2cd5b9c46903d01077dad0ebafdcef2de6d9e0664d67
SHA512

f8f3bce1abdf8d52d9264f143f62283153f7caf4d25948b7098082adff1fb007fd3444c77c18db66edb71dc6a2433296e91dd73c4ea01ef14a700937f0d3dbf9
SSDEEP

384:dY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZsq9+:SL2s+tRyRpcnuTP

Score

10^/10

njrat lammer discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Lammer

C2

troia23.duckdns.org:1177

Mutex

bcb4c719d2ef301534574d61226c5663

Attributes

reg_key
bcb4c719d2ef301534574d61226c5663
splitter
|'|'|

Targets

- Target
  
  68021ca2722cb5eadaed2cd5b9c46903d01077dad0ebafdcef2de6d9e0664d67.exe
- Size
  
  23KB
- MD5
  
  3da0670c583abb45648e3f0c6ab5089e
- SHA1
  
  5ac7e03ff02e77a5dcb094165759ad8fcec72b88
- SHA256
  
  68021ca2722cb5eadaed2cd5b9c46903d01077dad0ebafdcef2de6d9e0664d67
- SHA512
  
  f8f3bce1abdf8d52d9264f143f62283153f7caf4d25948b7098082adff1fb007fd3444c77c18db66edb71dc6a2433296e91dd73c4ea01ef14a700937f0d3dbf9
- SSDEEP
  
  384:dY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZsq9+:SL2s+tRyRpcnuTP
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan