njrat | c016b586d23e984c895c0682cc93fc41c0c6b518056cd4d4bacbfa266024d800 | Triage

Sharing

General

Target

c016b586d23e984c895c0682cc93fc41c0c6b518056cd4d4bacbfa266024d800
Size

31KB
Sample

240928-b57dyasgnf
MD5

69254135bd4d1848ddce56b2125f927d
SHA1

1c325a2cec243a1c2133c58e3f01119feb62d5f0
SHA256

c016b586d23e984c895c0682cc93fc41c0c6b518056cd4d4bacbfa266024d800
SHA512

07c7bb55e9a378b76dea44aeb63b61d9db38f08e577f658146237e2541aefc3b9bdab78ba93de442c8531ced59805b5ec1838ad722a5220cdfc76ea2744af599
SSDEEP

768:PFG5TP1/plIzxTCfVYAvN1Zvy/QmIDUu0ti8bj:4b1ay/YQVknj

Score

10^/10

njrat mybot discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

C2

127.0.0.1:1177

Mutex

086e692be851e3bfdee20dd56bf5111b

Attributes

reg_key
086e692be851e3bfdee20dd56bf5111b
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  c016b586d23e984c895c0682cc93fc41c0c6b518056cd4d4bacbfa266024d800
- Size
  
  31KB
- MD5
  
  69254135bd4d1848ddce56b2125f927d
- SHA1
  
  1c325a2cec243a1c2133c58e3f01119feb62d5f0
- SHA256
  
  c016b586d23e984c895c0682cc93fc41c0c6b518056cd4d4bacbfa266024d800
- SHA512
  
  07c7bb55e9a378b76dea44aeb63b61d9db38f08e577f658146237e2541aefc3b9bdab78ba93de442c8531ced59805b5ec1838ad722a5220cdfc76ea2744af599
- SSDEEP
  
  768:PFG5TP1/plIzxTCfVYAvN1Zvy/QmIDUu0ti8bj:4b1ay/YQVknj
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan