njrat | a88edeb377205df24d69e4215b7d48f251231fdca07763cb498b9b0107629eca | Triage

Sharing

General

Target

a88edeb377205df24d69e4215b7d48f251231fdca07763cb498b9b0107629eca.exe
Size

23KB
Sample

240927-yrmhyazand
MD5

4c9d43b1e31e151789a1ac9d15fd994b
SHA1

9b5dd2d92bbb37958e382abd780dc6c0d3c890d6
SHA256

a88edeb377205df24d69e4215b7d48f251231fdca07763cb498b9b0107629eca
SHA512

dc9c82917ff3a9d97b65e06bf4a9d6b7a66b92e6aeadfe6fad7fed48c999f1adb6c6f7a2b58aa1034dddbee30e0d308ad78f1ecfa16b2eb78234e1484998a060
SSDEEP

384:BYmCsg/yJrQ7hucGSl7UJx4g6JgfCcosjddmRvR6JZlbw8hqIusZzZ+1:WrG0Btl7rRpcnud

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:1177

Mutex

891dc742d2b9d5a353d6aef233a0e741

Attributes

reg_key
891dc742d2b9d5a353d6aef233a0e741
splitter
|'|'|

Targets

- Target
  
  a88edeb377205df24d69e4215b7d48f251231fdca07763cb498b9b0107629eca.exe
- Size
  
  23KB
- MD5
  
  4c9d43b1e31e151789a1ac9d15fd994b
- SHA1
  
  9b5dd2d92bbb37958e382abd780dc6c0d3c890d6
- SHA256
  
  a88edeb377205df24d69e4215b7d48f251231fdca07763cb498b9b0107629eca
- SHA512
  
  dc9c82917ff3a9d97b65e06bf4a9d6b7a66b92e6aeadfe6fad7fed48c999f1adb6c6f7a2b58aa1034dddbee30e0d308ad78f1ecfa16b2eb78234e1484998a060
- SSDEEP
  
  384:BYmCsg/yJrQ7hucGSl7UJx4g6JgfCcosjddmRvR6JZlbw8hqIusZzZ+1:WrG0Btl7rRpcnud
Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan