njrat | 1607f1ef2be3b4e291530c0e1f10558e3745d8553fcf7476a2b0c7930c6fab96 | Triage

Sharing

General

Target

f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118
Size

93KB
Sample

240925-s567lstclq
MD5

f655650ed251a7a651dd2f81d1bf9737
SHA1

5886e7d5587d910c8ab5925ebfffe0503c82e9a6
SHA256

1607f1ef2be3b4e291530c0e1f10558e3745d8553fcf7476a2b0c7930c6fab96
SHA512

f47ea2e216b17e9b4f12512fc17a5d74b2eacc653a40f01e6986ceb59dfd098db43784b093aca6d52db7b231570c57629eb8d2e812fe5f5a979353b5ef317203
SSDEEP

1536:eS3xh6Yl0fHbvhwI7Uc0NTeKsYgBSoIJ0K8p9f+yq:e6vlQbCIOpMM5qp9fBq

Score

10^/10

njrat 49277 reupload 03/07/2015 evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

49277 reupload 03/07/2015

C2

openvpnn.ddns.net:606

Mutex

1714db86e735c1ffae8c449f489875c7

Attributes

reg_key
1714db86e735c1ffae8c449f489875c7
splitter
|'|'|

Targets

- Target
  
  f655650ed251a7a651dd2f81d1bf9737_JaffaCakes118
- Size
  
  93KB
- MD5
  
  f655650ed251a7a651dd2f81d1bf9737
- SHA1
  
  5886e7d5587d910c8ab5925ebfffe0503c82e9a6
- SHA256
  
  1607f1ef2be3b4e291530c0e1f10558e3745d8553fcf7476a2b0c7930c6fab96
- SHA512
  
  f47ea2e216b17e9b4f12512fc17a5d74b2eacc653a40f01e6986ceb59dfd098db43784b093aca6d52db7b231570c57629eb8d2e812fe5f5a979353b5ef317203
- SSDEEP
  
  1536:eS3xh6Yl0fHbvhwI7Uc0NTeKsYgBSoIJ0K8p9f+yq:e6vlQbCIOpMM5qp9fBq
Score

10^/10

njrat 49277 reupload 03/07/2015 evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrat49277 reupload 03/07/2015evasionpersistenceprivilege_escalationtrojan

behavioral2

njrat49277 reupload 03/07/2015evasionpersistenceprivilege_escalationtrojan