njrat | 9369005476bf67bbe2aa275b11ac7393047d5821a4b27cbcbafd3f9c710ce19f | Triage

Sharing

General

Target

21a1f60c89f51fb759f7476c482fc800N
Size

337KB
Sample

240914-y7eg9stgrm
MD5

21a1f60c89f51fb759f7476c482fc800
SHA1

9d04c0588c6fc6819f816dadf1d9eab80d54aa80
SHA256

9369005476bf67bbe2aa275b11ac7393047d5821a4b27cbcbafd3f9c710ce19f
SHA512

8b9ab7fa79b8079469927b55b61c77493ff891240abca6d6dad095b6255beb65107219f754b8ea863a156f63f1d171f60c937ec237c5597d9c0ba6f692ee630d
SSDEEP

3072:tLN2YwhzfnI7vNgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:FwYyz/IzN1+fIyG5jZkCwi8r

Score

10^/10

njrat discovery persistence trojan

Malware Config

Targets

- Target
  
  21a1f60c89f51fb759f7476c482fc800N
- Size
  
  337KB
- MD5
  
  21a1f60c89f51fb759f7476c482fc800
- SHA1
  
  9d04c0588c6fc6819f816dadf1d9eab80d54aa80
- SHA256
  
  9369005476bf67bbe2aa275b11ac7393047d5821a4b27cbcbafd3f9c710ce19f
- SHA512
  
  8b9ab7fa79b8079469927b55b61c77493ff891240abca6d6dad095b6255beb65107219f754b8ea863a156f63f1d171f60c937ec237c5597d9c0ba6f692ee630d
- SSDEEP
  
  3072:tLN2YwhzfnI7vNgYfc0DV+1BIyLK5jZWlfXXqyYwi8x4Yfc09:FwYyz/IzN1+fIyG5jZkCwi8r
Score

10^/10

njrat discovery persistence trojan
- Adds autorun key to be loaded by Explorer.exe on startup
  persistence
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoverypersistencetrojan

behavioral2

njratdiscoverypersistencetrojan