njrat | 3ef14ed0395fec5f9167b9c7beea952c78a6a658268b44f9f186653d81b962b9 | Triage

Sharing

General

Target

d536db6ffac6e81abb29011621ce0780N.exe
Size

337KB
Sample

240821-devnkaxajd
MD5

d536db6ffac6e81abb29011621ce0780
SHA1

2697416ae7042a92218880e3165f09d1278c91d4
SHA256

3ef14ed0395fec5f9167b9c7beea952c78a6a658268b44f9f186653d81b962b9
SHA512

afe347b96e2eee35558a7e31c3bcfbe9a543a086f61100da3c016cc3393858a3488d13f0dbc931e308e2dc3114ba6e670e5e3da1a1bb717cd464cfc16642f9ed
SSDEEP

3072:/dPdEcTfCe157RgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:VPdLd57R1+fIyG5jZkCwi8r

Score

10^/10

njrat discovery persistence trojan

Malware Config

Targets

- Target
  
  d536db6ffac6e81abb29011621ce0780N.exe
- Size
  
  337KB
- MD5
  
  d536db6ffac6e81abb29011621ce0780
- SHA1
  
  2697416ae7042a92218880e3165f09d1278c91d4
- SHA256
  
  3ef14ed0395fec5f9167b9c7beea952c78a6a658268b44f9f186653d81b962b9
- SHA512
  
  afe347b96e2eee35558a7e31c3bcfbe9a543a086f61100da3c016cc3393858a3488d13f0dbc931e308e2dc3114ba6e670e5e3da1a1bb717cd464cfc16642f9ed
- SSDEEP
  
  3072:/dPdEcTfCe157RgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:VPdLd57R1+fIyG5jZkCwi8r
Score

10^/10

njrat discovery persistence trojan
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoverypersistencetrojan

behavioral2

njratdiscoverypersistencetrojan