njrat | f67835972297a83239c92c4f76eafa46d6d34c87af3bff31fb8d2f034873f831 | Triage

Sharing

General

Target

bae82b7001b12878a9fef23387ad1730N
Size

93KB
Sample

240913-ryblpatfrp
MD5

bae82b7001b12878a9fef23387ad1730
SHA1

3b6719573121db102b8d87f32c7bad03150fbfbc
SHA256

f67835972297a83239c92c4f76eafa46d6d34c87af3bff31fb8d2f034873f831
SHA512

7ce11f025038081b61d02dfe68a14a3e410c75a46d2f82d1bb89cb929e85b71f949d4bb82e057cc943e6c541df0f10c6122518eb0bcad652a233bece83c03bff
SSDEEP

768:vY3Kx530YTXspgM0m2zGjpyDtdXWuDtXfLWhyXxrjEtCdnl2pi1Rz4Rk3TsGdpR3:jxZ0AA0mT1mrWgL5jEwzGi1dD/DRgS

Score

10^/10

njrat roblox discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

RobLox

C2

hakim32.ddns.net:2000

127.0.0.1:5552

Mutex

54bcd0184406f711ed38737b8c13fd6e

Attributes

reg_key
54bcd0184406f711ed38737b8c13fd6e
splitter
|'|'|

Targets

- Target
  
  bae82b7001b12878a9fef23387ad1730N
- Size
  
  93KB
- MD5
  
  bae82b7001b12878a9fef23387ad1730
- SHA1
  
  3b6719573121db102b8d87f32c7bad03150fbfbc
- SHA256
  
  f67835972297a83239c92c4f76eafa46d6d34c87af3bff31fb8d2f034873f831
- SHA512
  
  7ce11f025038081b61d02dfe68a14a3e410c75a46d2f82d1bb89cb929e85b71f949d4bb82e057cc943e6c541df0f10c6122518eb0bcad652a233bece83c03bff
- SSDEEP
  
  768:vY3Kx530YTXspgM0m2zGjpyDtdXWuDtXfLWhyXxrjEtCdnl2pi1Rz4Rk3TsGdpR3:jxZ0AA0mT1mrWgL5jEwzGi1dD/DRgS
Score

10^/10

njrat roblox discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratrobloxdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

discoveryevasionpersistenceprivilege_escalation