njrat | 2aad7f7edf402c984b9470586e8676190a72c59ccd8a232d5010eece7e85d451 | Triage

Sharing

General

Target

2aad7f7edf402c984b9470586e8676190a72c59ccd8a232d5010eece7e85d451.exe
Size

23KB
Sample

240928-j5e9fswajr
MD5

feca5b6e403c966c33da5dc364a3693d
SHA1

29b456da0f41924d4ddc9117332fc2a44bfda6cb
SHA256

2aad7f7edf402c984b9470586e8676190a72c59ccd8a232d5010eece7e85d451
SHA512

400196e5f3fa0d47eb30726c61cd15e55e80a062be93968eb3aa459be1c9bbd0c7f3c944e1a57cc64fa8280069aee39ef635642a64dd1ff9b96d52f5b1f2b831
SSDEEP

384:5sqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZ7DU:yf65K2Yf1jKRpcnukU

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

myhotkkk444.duckdns.org:4444

Mutex

c760fcd136526bb1a5afbbf5d7e84b71

Attributes

reg_key
c760fcd136526bb1a5afbbf5d7e84b71
splitter
|'|'|

Targets

- Target
  
  2aad7f7edf402c984b9470586e8676190a72c59ccd8a232d5010eece7e85d451.exe
- Size
  
  23KB
- MD5
  
  feca5b6e403c966c33da5dc364a3693d
- SHA1
  
  29b456da0f41924d4ddc9117332fc2a44bfda6cb
- SHA256
  
  2aad7f7edf402c984b9470586e8676190a72c59ccd8a232d5010eece7e85d451
- SHA512
  
  400196e5f3fa0d47eb30726c61cd15e55e80a062be93968eb3aa459be1c9bbd0c7f3c944e1a57cc64fa8280069aee39ef635642a64dd1ff9b96d52f5b1f2b831
- SSDEEP
  
  384:5sqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZ7DU:yf65K2Yf1jKRpcnukU
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan