njrat | c7573b7e2c5a7b2cb3387d85df4f945554b96f284b752ae049a855d006008b06 | Triage

Sharing

General

Target

c7573b7e2c5a7b2cb3387d85df4f945554b96f284b752ae049a855d006008b06
Size

332KB
Sample

240903-eavy7sxend
MD5

312055ca68c2f33e971dc5f806a9400f
SHA1

09dcafcea550b48f9d8201c9387f2de5243205b4
SHA256

c7573b7e2c5a7b2cb3387d85df4f945554b96f284b752ae049a855d006008b06
SHA512

0d9dcadbba1da9ddc59519b700d276a41066d0a1c9cd043ca7a1b50572fb0a6591b1d82e2f07d114e8a510f54f1ac298e9ae5b16bca511f5c33265621e92d63b
SSDEEP

1536:Zzpo4ryEt0UaF5bLcXZJvfhDjEguP6dIbTG:bolUubQ/nhDISyTG

Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  c7573b7e2c5a7b2cb3387d85df4f945554b96f284b752ae049a855d006008b06
- Size
  
  332KB
- MD5
  
  312055ca68c2f33e971dc5f806a9400f
- SHA1
  
  09dcafcea550b48f9d8201c9387f2de5243205b4
- SHA256
  
  c7573b7e2c5a7b2cb3387d85df4f945554b96f284b752ae049a855d006008b06
- SHA512
  
  0d9dcadbba1da9ddc59519b700d276a41066d0a1c9cd043ca7a1b50572fb0a6591b1d82e2f07d114e8a510f54f1ac298e9ae5b16bca511f5c33265621e92d63b
- SSDEEP
  
  1536:Zzpo4ryEt0UaF5bLcXZJvfhDjEguP6dIbTG:bolUubQ/nhDISyTG
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan