njrat | f3f9e98f471d4773e34e9c17046dcb979ce814b7ec57ab06d8a6374e5092dacb | Triage

Sharing

General

Target

7ea53bbc3f1b3b7f8ad0384d2a0eab70N.exe
Size

29KB
Sample

240828-176ymayhlc
MD5

7ea53bbc3f1b3b7f8ad0384d2a0eab70
SHA1

ae0285e3567a4cad47e28d126b1a67d28d4622a1
SHA256

f3f9e98f471d4773e34e9c17046dcb979ce814b7ec57ab06d8a6374e5092dacb
SHA512

67a483079304274cfe2196f5196246f2cce98dcf56bb118e989ad8bb5d763a29c1371d9666eacf801f43a0f41a9b76f52b5b6443f1a803ef9d384a4a06e66577
SSDEEP

384:dhpQjtl7jBnoKoK3JX15nHK4GumqDAEReIlGBsbh0w4wlAokw9OhgOL1vYRGOZzw:d27hoKoGJFNK4Aq1RehBKh0p29SgRdO

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

127.0.0.1:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Targets

- Target
  
  7ea53bbc3f1b3b7f8ad0384d2a0eab70N.exe
- Size
  
  29KB
- MD5
  
  7ea53bbc3f1b3b7f8ad0384d2a0eab70
- SHA1
  
  ae0285e3567a4cad47e28d126b1a67d28d4622a1
- SHA256
  
  f3f9e98f471d4773e34e9c17046dcb979ce814b7ec57ab06d8a6374e5092dacb
- SHA512
  
  67a483079304274cfe2196f5196246f2cce98dcf56bb118e989ad8bb5d763a29c1371d9666eacf801f43a0f41a9b76f52b5b6443f1a803ef9d384a4a06e66577
- SSDEEP
  
  384:dhpQjtl7jBnoKoK3JX15nHK4GumqDAEReIlGBsbh0w4wlAokw9OhgOL1vYRGOZzw:d27hoKoGJFNK4Aq1RehBKh0p29SgRdO
Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

discoveryevasionpersistenceprivilege_escalation