njrat | e805bcd71c7bb24b3b00583728052f1dd0bd4d1ad15a538e19351fa2aabf505a | Triage

Sharing

General

Target

e805bcd71c7bb24b3b00583728052f1dd0bd4d1ad15a538e19351fa2aabf505a
Size

36KB
Sample

240921-nd1hjazcpn
MD5

b35cebcb33c04ddfd8a12e10d5cf397e
SHA1

5f17d2b5b1d349cbd250044c4b78f1ad69c031d2
SHA256

e805bcd71c7bb24b3b00583728052f1dd0bd4d1ad15a538e19351fa2aabf505a
SHA512

55fabebee25a0dc3fb7da0effe5fd47b291a61548dfdcc4c81310e62865bae66e2adf5586cda1b11935ee44fe7a4c5e84f1c58893da355a7a4f23b7fc606eb4b
SSDEEP

384:Ww2jKicgojn5xL5oyUi8eTlijnfTcY6AlWrAF+rMRTyN/0L+EcoinblneHQM3ep3:12Kf5DUi8UijnQFAArM+rMRa8Nuest

Score

10^/10

njrat itzm7d_hacker discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

iTzM7D_Hacker

C2

sound-falls.gl.at.ply.gg:28135

Mutex

103fbd81f4097871dc9013d7d368121f

Attributes

reg_key
103fbd81f4097871dc9013d7d368121f
splitter
|'|'|

Targets

- Target
  
  e805bcd71c7bb24b3b00583728052f1dd0bd4d1ad15a538e19351fa2aabf505a
- Size
  
  36KB
- MD5
  
  b35cebcb33c04ddfd8a12e10d5cf397e
- SHA1
  
  5f17d2b5b1d349cbd250044c4b78f1ad69c031d2
- SHA256
  
  e805bcd71c7bb24b3b00583728052f1dd0bd4d1ad15a538e19351fa2aabf505a
- SHA512
  
  55fabebee25a0dc3fb7da0effe5fd47b291a61548dfdcc4c81310e62865bae66e2adf5586cda1b11935ee44fe7a4c5e84f1c58893da355a7a4f23b7fc606eb4b
- SSDEEP
  
  384:Ww2jKicgojn5xL5oyUi8eTlijnfTcY6AlWrAF+rMRTyN/0L+EcoinblneHQM3ep3:12Kf5DUi8UijnQFAArM+rMRa8Nuest
Score

10^/10

njrat itzm7d_hacker discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

itzm7d_hackernjrat

behavioral1

njratitzm7d_hackerdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

discoveryevasionpersistenceprivilege_escalation