njrat | 5416aa70c4266acf4207ce0abffd5a2a56b1f86d5310a7a00b90959ab888fea5 | Triage

Sharing

General

Target

310ccab5ca032fec6cff5106f9ddde10N.exe
Size

23KB
Sample

240906-l6tjkszglp
MD5

310ccab5ca032fec6cff5106f9ddde10
SHA1

719b357107026a3ddcad192cdb38c77a35c9456b
SHA256

5416aa70c4266acf4207ce0abffd5a2a56b1f86d5310a7a00b90959ab888fea5
SHA512

10e7272ddef6a0a069d3c7dddef50cad9d633d2ad73937fb8ef648d4910a8eeba9fe8c69f64448e121d5fe30e15766556f1a8ba4c7e3d388e876a42f17a2e62a
SSDEEP

384:k8aLWS0dABLYVq6RxP8MDFF09vK563gRMmJKUv0mRvR6JZlbw8hqIusZzZFA:jXcwt3tRpcnuZ

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

9b680686af0752fa5ec38973627111d7

Attributes

reg_key
9b680686af0752fa5ec38973627111d7
splitter
|'|'|

Targets

- Target
  
  310ccab5ca032fec6cff5106f9ddde10N.exe
- Size
  
  23KB
- MD5
  
  310ccab5ca032fec6cff5106f9ddde10
- SHA1
  
  719b357107026a3ddcad192cdb38c77a35c9456b
- SHA256
  
  5416aa70c4266acf4207ce0abffd5a2a56b1f86d5310a7a00b90959ab888fea5
- SHA512
  
  10e7272ddef6a0a069d3c7dddef50cad9d633d2ad73937fb8ef648d4910a8eeba9fe8c69f64448e121d5fe30e15766556f1a8ba4c7e3d388e876a42f17a2e62a
- SSDEEP
  
  384:k8aLWS0dABLYVq6RxP8MDFF09vK563gRMmJKUv0mRvR6JZlbw8hqIusZzZFA:jXcwt3tRpcnuZ
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan