njrat | f014c3c7f1b1d9b831fcd81ab97a7508b6f5b1c290f1bd4b7aeaea2657998bc6 | Triage

Sharing

General

Target

f014c3c7f1b1d9b831fcd81ab97a7508b6f5b1c290f1bd4b7aeaea2657998bc6
Size

698KB
Sample

240915-c9l48ssapj
MD5

5588995bafbfef1866fb110db534239a
SHA1

64a06074f98c6b0d103f2c6849768aa3ef5f4a59
SHA256

f014c3c7f1b1d9b831fcd81ab97a7508b6f5b1c290f1bd4b7aeaea2657998bc6
SHA512

ab6de29b94def87fa2faee4a3a25b647400c9d5e14f604f0cb20b9db375ddd308375f16d14d1bce799c078890abef99c579dc850e7687e3dedfb7f7f1214bf95
SSDEEP

3072:Y2JN+n6fW/m4mwp+P+GP2PnP4gfpHPxARHIPAIh1+P4PVoguv+OWRvp5XWe45GQf:Y

Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  f014c3c7f1b1d9b831fcd81ab97a7508b6f5b1c290f1bd4b7aeaea2657998bc6
- Size
  
  698KB
- MD5
  
  5588995bafbfef1866fb110db534239a
- SHA1
  
  64a06074f98c6b0d103f2c6849768aa3ef5f4a59
- SHA256
  
  f014c3c7f1b1d9b831fcd81ab97a7508b6f5b1c290f1bd4b7aeaea2657998bc6
- SHA512
  
  ab6de29b94def87fa2faee4a3a25b647400c9d5e14f604f0cb20b9db375ddd308375f16d14d1bce799c078890abef99c579dc850e7687e3dedfb7f7f1214bf95
- SSDEEP
  
  3072:Y2JN+n6fW/m4mwp+P+GP2PnP4gfpHPxARHIPAIh1+P4PVoguv+OWRvp5XWe45GQf:Y
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan