njrat | 38451f9cee47daf6fa98fee356ebf5a18194c5c5fa4d2ffc69af515a60de5e8c | Triage

Sharing

General

Target

38451f9cee47daf6fa98fee356ebf5a18194c5c5fa4d2ffc69af515a60de5e8c.exe
Size

37KB
Sample

240927-rhnw3swdnn
MD5

56eaff4406bc90d0671285a7ecb67cb2
SHA1

c0cdd9a413157fad109391cc045428cef70ed197
SHA256

38451f9cee47daf6fa98fee356ebf5a18194c5c5fa4d2ffc69af515a60de5e8c
SHA512

d1fa94d54b150a9c93528049fec70c7bb59e1a87a8e46dba5f04bb3febad06deefb6c5cc09d24a9e69f0b3b317590747341feab84883379c36f239e1868629f9
SSDEEP

384:+iaCiMmB63fbw6ZfrZUy8fCiHVugmB+xRrAF+rMRTyN/0L+EcoinblneHQM3epz9:X60DwODZX8fCiEd+/rM+rMRa8NuJhVt

Score

10^/10

njrat hacked by killer discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed By KiLLeR

C2

killerfo2.ddns.net:1177

Mutex

61e53fca4b50eaee89f696351aed3589

Attributes

reg_key
61e53fca4b50eaee89f696351aed3589
splitter
|'|'|

Targets

- Target
  
  38451f9cee47daf6fa98fee356ebf5a18194c5c5fa4d2ffc69af515a60de5e8c.exe
- Size
  
  37KB
- MD5
  
  56eaff4406bc90d0671285a7ecb67cb2
- SHA1
  
  c0cdd9a413157fad109391cc045428cef70ed197
- SHA256
  
  38451f9cee47daf6fa98fee356ebf5a18194c5c5fa4d2ffc69af515a60de5e8c
- SHA512
  
  d1fa94d54b150a9c93528049fec70c7bb59e1a87a8e46dba5f04bb3febad06deefb6c5cc09d24a9e69f0b3b317590747341feab84883379c36f239e1868629f9
- SSDEEP
  
  384:+iaCiMmB63fbw6ZfrZUy8fCiHVugmB+xRrAF+rMRTyN/0L+EcoinblneHQM3epz9:X60DwODZX8fCiEd+/rM+rMRa8NuJhVt
Score

10^/10

njrat hacked by killer discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

hacked by killernjrat

behavioral1

njrathacked by killerdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

discoveryevasionpersistenceprivilege_escalation