njrat | 3ca5871b409cebd1d8f13e0c9afdd4f3999272206e0648b2138fbb41cb9cb1bf | Triage

Sharing

General

Target

ef71105eb93854135abead9616cd8368_JaffaCakes118
Size

74KB
Sample

240921-kqgpeatelc
MD5

ef71105eb93854135abead9616cd8368
SHA1

bda3a6a64be575e9946efbad306dd6c80c036d71
SHA256

3ca5871b409cebd1d8f13e0c9afdd4f3999272206e0648b2138fbb41cb9cb1bf
SHA512

7a13a6c5192e7321185f19511a9581e90b0f284183fba167a4af0e15afb7f1f52f2d63547f421548c2039cd8ea8ac810ab4f144c560c56d85c19df82b2cdd18f
SSDEEP

1536:07algoWDgtr2ZPdY9eX+DC7PWhtFmGn+NWBeuePdkiw:01Lir2ZPO9W4CDit7YK+1r

Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  ef71105eb93854135abead9616cd8368_JaffaCakes118
- Size
  
  74KB
- MD5
  
  ef71105eb93854135abead9616cd8368
- SHA1
  
  bda3a6a64be575e9946efbad306dd6c80c036d71
- SHA256
  
  3ca5871b409cebd1d8f13e0c9afdd4f3999272206e0648b2138fbb41cb9cb1bf
- SHA512
  
  7a13a6c5192e7321185f19511a9581e90b0f284183fba167a4af0e15afb7f1f52f2d63547f421548c2039cd8ea8ac810ab4f144c560c56d85c19df82b2cdd18f
- SSDEEP
  
  1536:07algoWDgtr2ZPdY9eX+DC7PWhtFmGn+NWBeuePdkiw:01Lir2ZPO9W4CDit7YK+1r
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan