njrat | c098756128e63736c0afe05607b4bcf08b550aa26b6200f9cd29729136c5ec4c | Triage

Sharing

General

Target

e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118
Size

153KB
Sample

240915-1d3zwathkm
MD5

e3660d1c128b1d65b91bd03fdeb65ac9
SHA1

27cf3b67238cc1cd30c276e52edbdf407eaf6427
SHA256

c098756128e63736c0afe05607b4bcf08b550aa26b6200f9cd29729136c5ec4c
SHA512

8cfc502ba8858265e2339a59edd00a8794899f380c132b7b26366b30e4878d440d785b4cf6dda36737ab1978ee38913d531c224be0bc623bf7719391cd634a72
SSDEEP

3072:nqjtlbsvvzDl8LW6l7/wP+9O4OzmNGYdVgFXrPn3eFUSG1fYBVjL:qwSK6lBO4OeUh8zG1fY3H

Score

10^/10

njrat ftd discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

FTD

C2

amon008.duckdns.org:1006

Mutex

6c1567cde2639e7f2e31584fc3be4bb7

Attributes

reg_key
6c1567cde2639e7f2e31584fc3be4bb7
splitter
|'|'|

Targets

- Target
  
  e3660d1c128b1d65b91bd03fdeb65ac9_JaffaCakes118
- Size
  
  153KB
- MD5
  
  e3660d1c128b1d65b91bd03fdeb65ac9
- SHA1
  
  27cf3b67238cc1cd30c276e52edbdf407eaf6427
- SHA256
  
  c098756128e63736c0afe05607b4bcf08b550aa26b6200f9cd29729136c5ec4c
- SHA512
  
  8cfc502ba8858265e2339a59edd00a8794899f380c132b7b26366b30e4878d440d785b4cf6dda36737ab1978ee38913d531c224be0bc623bf7719391cd634a72
- SSDEEP
  
  3072:nqjtlbsvvzDl8LW6l7/wP+9O4OzmNGYdVgFXrPn3eFUSG1fYBVjL:qwSK6lBO4OeUh8zG1fY3H
Score

10^/10

njrat ftd discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratftddiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratftddiscoveryevasionpersistenceprivilege_escalationtrojan