njrat | 78fb81d836eb99c2510a651b21c1e7247e4ba247e9aa8610f3275da82006764c | Triage

Sharing

General

Target

d71f87e8ed7e945769e969354024fbc0N
Size

37KB
Sample

240908-fd1jjaxdqr
MD5

d71f87e8ed7e945769e969354024fbc0
SHA1

f9136306cf4f824adf0162da94ecdd2242b0a385
SHA256

78fb81d836eb99c2510a651b21c1e7247e4ba247e9aa8610f3275da82006764c
SHA512

a58607924033413ec889cc9e59a4b3bcbe6312e8bc0b490cbf71fe22a5ba1d5bc423e5a44d66a31d210e7db60e33e426a99504ec4ccd429b81eb58fe7916a30c
SSDEEP

384:WMNTgiG1CVZfursvO6yszop0n/eT3wSArAF+rMRTyN/0L+EcoinblneHQM3epzXh:ZNh5Wpszop0mzw/rM+rMRa8Nud3t

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

178.33.93.88:5552

Mutex

49ca37437ba4e6f1397bccc3f904909d

Attributes

reg_key
49ca37437ba4e6f1397bccc3f904909d
splitter
|'|'|

Targets

- Target
  
  d71f87e8ed7e945769e969354024fbc0N
- Size
  
  37KB
- MD5
  
  d71f87e8ed7e945769e969354024fbc0
- SHA1
  
  f9136306cf4f824adf0162da94ecdd2242b0a385
- SHA256
  
  78fb81d836eb99c2510a651b21c1e7247e4ba247e9aa8610f3275da82006764c
- SHA512
  
  a58607924033413ec889cc9e59a4b3bcbe6312e8bc0b490cbf71fe22a5ba1d5bc423e5a44d66a31d210e7db60e33e426a99504ec4ccd429b81eb58fe7916a30c
- SSDEEP
  
  384:WMNTgiG1CVZfursvO6yszop0n/eT3wSArAF+rMRTyN/0L+EcoinblneHQM3epzXh:ZNh5Wpszop0mzw/rM+rMRa8Nud3t
Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

discoveryevasionpersistenceprivilege_escalation