njrat | d039a75f8d067e30b128cf730e2917422e4aa3dc016a872e12f74b922485c658 | Triage

Sharing

General

Target

c604f27c785ffbab49202bd4815a5856_JaffaCakes118
Size

180KB
Sample

240828-bz2aqszclg
MD5

c604f27c785ffbab49202bd4815a5856
SHA1

dec2b2e4af8ec88d5d1e395036e5d9a67583afbe
SHA256

d039a75f8d067e30b128cf730e2917422e4aa3dc016a872e12f74b922485c658
SHA512

8a0cf46beb7d46fd5c1c109fa7fe4f4b3ce5971313187df5039f2b0bfa36cc3e7155f424d78502c9ba47f9a4c8436ce60b55e459311fcfd4af63ba42b7169694
SSDEEP

3072:h3eSMOurnLtKzzVnnXjOh37bJZIfnOeSXpwtHa8oX6n83QeTR:dJeLczzVnnKbnQHlW6nSfT

Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  c604f27c785ffbab49202bd4815a5856_JaffaCakes118
- Size
  
  180KB
- MD5
  
  c604f27c785ffbab49202bd4815a5856
- SHA1
  
  dec2b2e4af8ec88d5d1e395036e5d9a67583afbe
- SHA256
  
  d039a75f8d067e30b128cf730e2917422e4aa3dc016a872e12f74b922485c658
- SHA512
  
  8a0cf46beb7d46fd5c1c109fa7fe4f4b3ce5971313187df5039f2b0bfa36cc3e7155f424d78502c9ba47f9a4c8436ce60b55e459311fcfd4af63ba42b7169694
- SSDEEP
  
  3072:h3eSMOurnLtKzzVnnXjOh37bJZIfnOeSXpwtHa8oX6n83QeTR:dJeLczzVnnKbnQHlW6nSfT
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan