njrat | f14dee8058e2a8c371f5db38d937a824a0ce9099513a001ac9eb9133f53c2d0c | Triage

Sharing

General

Target

f6059e332e31a0fca90cadc7a4fe0f63_JaffaCakes118
Size

159KB
Sample

240925-pqhc6avgmr
MD5

f6059e332e31a0fca90cadc7a4fe0f63
SHA1

82aac1683987885cff1c3048bad86452ab86b402
SHA256

f14dee8058e2a8c371f5db38d937a824a0ce9099513a001ac9eb9133f53c2d0c
SHA512

c766658a190087bc5a81da5b10e8d484120115fca3923a863baf4b667f9ab8afed16b7bc7fd536883d14f031bccb5cec3a755b94d99c2f65ac1ec8aa88fdd7a6
SSDEEP

3072:4gbbCIk1iTGmQdjzM+foZ0wWBNIBqtp6feH1bLr1VaAlGkn2BT7:3uORozM+foZJWBNkgA+15Va

Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  f6059e332e31a0fca90cadc7a4fe0f63_JaffaCakes118
- Size
  
  159KB
- MD5
  
  f6059e332e31a0fca90cadc7a4fe0f63
- SHA1
  
  82aac1683987885cff1c3048bad86452ab86b402
- SHA256
  
  f14dee8058e2a8c371f5db38d937a824a0ce9099513a001ac9eb9133f53c2d0c
- SHA512
  
  c766658a190087bc5a81da5b10e8d484120115fca3923a863baf4b667f9ab8afed16b7bc7fd536883d14f031bccb5cec3a755b94d99c2f65ac1ec8aa88fdd7a6
- SSDEEP
  
  3072:4gbbCIk1iTGmQdjzM+foZ0wWBNIBqtp6feH1bLr1VaAlGkn2BT7:3uORozM+foZJWBNkgA+15Va
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan