njrat | e75fdaab59454eb30d1ff6655477e3935b3dcbf4e36a99936ea6da059e6a1c75 | Triage

Sharing

General

Target

e75fdaab59454eb30d1ff6655477e3935b3dcbf4e36a99936ea6da059e6a1c75
Size

337KB
Sample

240911-qw645stapn
MD5

350b1ba341b358c6d15aa553da9671fa
SHA1

a18621a525de13fafccac91b3a7ad95668dfa6c8
SHA256

e75fdaab59454eb30d1ff6655477e3935b3dcbf4e36a99936ea6da059e6a1c75
SHA512

a3d7e90c54dadf7336dce11d6cae4e8fb7e7503a042bfed34eeeb0ff1bc453f6729e7ed3875f5085227f484bf30aca568c2dde8c179061edbe64c4e689776dc1
SSDEEP

3072:ypQ/zfZ0pgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:ypIfZ0p1+fIyG5jZkCwi8r

Score

10^/10

njrat discovery persistence trojan

Malware Config

Targets

- Target
  
  e75fdaab59454eb30d1ff6655477e3935b3dcbf4e36a99936ea6da059e6a1c75
- Size
  
  337KB
- MD5
  
  350b1ba341b358c6d15aa553da9671fa
- SHA1
  
  a18621a525de13fafccac91b3a7ad95668dfa6c8
- SHA256
  
  e75fdaab59454eb30d1ff6655477e3935b3dcbf4e36a99936ea6da059e6a1c75
- SHA512
  
  a3d7e90c54dadf7336dce11d6cae4e8fb7e7503a042bfed34eeeb0ff1bc453f6729e7ed3875f5085227f484bf30aca568c2dde8c179061edbe64c4e689776dc1
- SSDEEP
  
  3072:ypQ/zfZ0pgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:ypIfZ0p1+fIyG5jZkCwi8r
Score

10^/10

njrat discovery persistence trojan
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoverypersistencetrojan

behavioral2

njratdiscoverypersistencetrojan