njrat | 1db41e3285f0819f9f614052a76500038e9ec2433550c240aeceb2787b235808 | Triage

Sharing

General

Target

1db41e3285f0819f9f614052a76500038e9ec2433550c240aeceb2787b235808.exe
Size

31KB
Sample

240928-l14glasbng
MD5

582a25b26ea78d97686c3abf2732f80f
SHA1

a487f6870657f903dc947cf6bdd2055f8c2d4294
SHA256

1db41e3285f0819f9f614052a76500038e9ec2433550c240aeceb2787b235808
SHA512

ff167451e32b6aaef5bcf10bc784fdbc4ce9eb1bfd6bfdb44b747ede8587b4f69f15a06b659c3ca42ef4a65c30ecef1da9c059bf6ea7d74ce86e8b5267b7d9bd
SSDEEP

768:KvZghV5VXPKzxF+dt+XKvJ+rvajQmIDUu0ti84j:tfqciYQVkEj

Score

10^/10

njrat mybot discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

C2

127.0.0.1:8080

Mutex

9e549438c56317b24cd87c987b694da8

Attributes

reg_key
9e549438c56317b24cd87c987b694da8
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  1db41e3285f0819f9f614052a76500038e9ec2433550c240aeceb2787b235808.exe
- Size
  
  31KB
- MD5
  
  582a25b26ea78d97686c3abf2732f80f
- SHA1
  
  a487f6870657f903dc947cf6bdd2055f8c2d4294
- SHA256
  
  1db41e3285f0819f9f614052a76500038e9ec2433550c240aeceb2787b235808
- SHA512
  
  ff167451e32b6aaef5bcf10bc784fdbc4ce9eb1bfd6bfdb44b747ede8587b4f69f15a06b659c3ca42ef4a65c30ecef1da9c059bf6ea7d74ce86e8b5267b7d9bd
- SSDEEP
  
  768:KvZghV5VXPKzxF+dt+XKvJ+rvajQmIDUu0ti84j:tfqciYQVkEj
Score

10^/10

njrat mybot discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratmybotdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan