njrat | 0dfca39c7ebcca00525b6d29fb720a32396a12716322609498528bdcf91d8715 | Triage

Sharing

General

Target

0dfca39c7ebcca00525b6d29fb720a32396a12716322609498528bdcf91d8715.exe
Size

29KB
Sample

240927-yjxzpsyeqg
MD5

7eeb03f03f522d069360a11605d8c36f
SHA1

c822086cc3c0aeab9940880cccec95096d3fe5a4
SHA256

0dfca39c7ebcca00525b6d29fb720a32396a12716322609498528bdcf91d8715
SHA512

1d9d9d2915c2cc53840539bf71b4d200ed3744159dbdb56a85010f12600b891b34941fecdf455886c00a4b96ccbe1c903b3db7a8842a177ba1f99ac0db442b61
SSDEEP

384:IYs5l7VL9skVQ42BkSv5dAsCGmqDm+jeI7GBsbh0w4wlAokw9OhgOL1vYRGOZzoZ:k7/skCXkQossqtje3BKh0p29SgRiv

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

103.82.249.74:5552

Mutex

d3776686feb67f0c4d384296a8807cee

Attributes

reg_key
d3776686feb67f0c4d384296a8807cee
splitter
|'|'|

Targets

- Target
  
  0dfca39c7ebcca00525b6d29fb720a32396a12716322609498528bdcf91d8715.exe
- Size
  
  29KB
- MD5
  
  7eeb03f03f522d069360a11605d8c36f
- SHA1
  
  c822086cc3c0aeab9940880cccec95096d3fe5a4
- SHA256
  
  0dfca39c7ebcca00525b6d29fb720a32396a12716322609498528bdcf91d8715
- SHA512
  
  1d9d9d2915c2cc53840539bf71b4d200ed3744159dbdb56a85010f12600b891b34941fecdf455886c00a4b96ccbe1c903b3db7a8842a177ba1f99ac0db442b61
- SSDEEP
  
  384:IYs5l7VL9skVQ42BkSv5dAsCGmqDm+jeI7GBsbh0w4wlAokw9OhgOL1vYRGOZzoZ:k7/skCXkQossqtje3BKh0p29SgRiv
Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

discoveryevasionpersistenceprivilege_escalation