njrat | 13db598fe9e08707d4af0c3e3453146ec989c8bf21ca739d5e001f7c46ee35ab | Triage

Sharing

General

Target

f2d2eefd525c61f9bb228c9a60455300N.exe
Size

337KB
Sample

240907-k4dvnswfmh
MD5

f2d2eefd525c61f9bb228c9a60455300
SHA1

97652203e9672947d1cd981ff1dcde66268e0652
SHA256

13db598fe9e08707d4af0c3e3453146ec989c8bf21ca739d5e001f7c46ee35ab
SHA512

6e50285d89f1792a987522bf0707d038defe6288b8da7f3d17c5e29ddf6fdcd3df7bb6b21d17d3a98ce93521faa682cab38a9eb220fa9901c445ea7cfcc7ee26
SSDEEP

3072:3ayAN9I3ORXdl/iQQgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:37AN9I+RbrQ1+fIyG5jZkCwi8r

Score

10^/10

njrat discovery persistence trojan

Malware Config

Targets

- Target
  
  f2d2eefd525c61f9bb228c9a60455300N.exe
- Size
  
  337KB
- MD5
  
  f2d2eefd525c61f9bb228c9a60455300
- SHA1
  
  97652203e9672947d1cd981ff1dcde66268e0652
- SHA256
  
  13db598fe9e08707d4af0c3e3453146ec989c8bf21ca739d5e001f7c46ee35ab
- SHA512
  
  6e50285d89f1792a987522bf0707d038defe6288b8da7f3d17c5e29ddf6fdcd3df7bb6b21d17d3a98ce93521faa682cab38a9eb220fa9901c445ea7cfcc7ee26
- SSDEEP
  
  3072:3ayAN9I3ORXdl/iQQgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:37AN9I+RbrQ1+fIyG5jZkCwi8r
Score

10^/10

njrat discovery persistence trojan
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoverypersistencetrojan

behavioral2

njratdiscoverypersistencetrojan