njrat | 24de28a2d4c0be7a1605c5c0543f698e08f8529566ebefb44086f5ac8cb9f1f1 | Triage

Sharing

General

Target

24de28a2d4c0be7a1605c5c0543f698e08f8529566ebefb44086f5ac8cb9f1f1N
Size

76KB
Sample

240918-jlnrgszhkj
MD5

e9a9d4747d4450fc0d3647ae1b38d6d0
SHA1

e76e44a32902a088831593235449298b219e8567
SHA256

24de28a2d4c0be7a1605c5c0543f698e08f8529566ebefb44086f5ac8cb9f1f1
SHA512

7f1dccc392163d04a03c5daba76ef4211ad2ebb1089b7590575ab599713aae4c36cab63c14e73f1be4dbebe218c49142a44114091da3e1bd28698399c798ed7a
SSDEEP

1536:PpyX5NjhErxpyzyvPadESZ0FjfgQrLpfS:PYX5jErxpyzyadERRfgQrVq

Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  24de28a2d4c0be7a1605c5c0543f698e08f8529566ebefb44086f5ac8cb9f1f1N
- Size
  
  76KB
- MD5
  
  e9a9d4747d4450fc0d3647ae1b38d6d0
- SHA1
  
  e76e44a32902a088831593235449298b219e8567
- SHA256
  
  24de28a2d4c0be7a1605c5c0543f698e08f8529566ebefb44086f5ac8cb9f1f1
- SHA512
  
  7f1dccc392163d04a03c5daba76ef4211ad2ebb1089b7590575ab599713aae4c36cab63c14e73f1be4dbebe218c49142a44114091da3e1bd28698399c798ed7a
- SSDEEP
  
  1536:PpyX5NjhErxpyzyvPadESZ0FjfgQrLpfS:PYX5jErxpyzyadERRfgQrVq
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan