njrat | 52c917eead7347335ee26e3f7c7f73a4b86e59fd5e30ed838528547407a55c0e | Triage

Sharing

General

Target

d238f9157331f1b067d632b39bd738c0N.exe
Size

337KB
Sample

240909-wvz74asckp
MD5

d238f9157331f1b067d632b39bd738c0
SHA1

2d967dbae8e5b7694babaa41b574d6a41fd8f971
SHA256

52c917eead7347335ee26e3f7c7f73a4b86e59fd5e30ed838528547407a55c0e
SHA512

8650aeff936f87e882fd4515372b5ae1b076bda3d89e072bf5c7139105dc937a7bb5361a9605774fc6d0a37fbde5bb99e868b2802fcb5f21f9dc3c42edd40b82
SSDEEP

3072:j24OkAZuXY7w9gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:3CZMY091+fIyG5jZkCwi8r

Score

10^/10

njrat discovery persistence trojan

Malware Config

Targets

- Target
  
  d238f9157331f1b067d632b39bd738c0N.exe
- Size
  
  337KB
- MD5
  
  d238f9157331f1b067d632b39bd738c0
- SHA1
  
  2d967dbae8e5b7694babaa41b574d6a41fd8f971
- SHA256
  
  52c917eead7347335ee26e3f7c7f73a4b86e59fd5e30ed838528547407a55c0e
- SHA512
  
  8650aeff936f87e882fd4515372b5ae1b076bda3d89e072bf5c7139105dc937a7bb5361a9605774fc6d0a37fbde5bb99e868b2802fcb5f21f9dc3c42edd40b82
- SSDEEP
  
  3072:j24OkAZuXY7w9gYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:3CZMY091+fIyG5jZkCwi8r
Score

10^/10

njrat discovery persistence trojan
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

System Network Configuration Discovery

Internet Connection Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoverypersistencetrojan

behavioral2

njratdiscoverypersistencetrojan