njrat | 9afb798850a3e6a18a58ee03649cfc63b020502585f27cede5b75754546cabf6 | Triage

Sharing

General

Target

9afb798850a3e6a18a58ee03649cfc63b020502585f27cede5b75754546cabf6
Size

31KB
Sample

240930-axg9eayblm
MD5

f3f0ccda18da89e09238baac20aebfe8
SHA1

be11f524fc269e7f54b699aaaeb98ddbeac0dfc6
SHA256

9afb798850a3e6a18a58ee03649cfc63b020502585f27cede5b75754546cabf6
SHA512

639ae3316eb8570f8b67039f7cd4a22811e53b0fbc6599bc98cc1bdbc6202c099ac0ab246a1931699b3f14143293696d338f12643839c05802f3cee0e51fa525
SSDEEP

768:2hSp69DdxkzxP6bo8SG3FQNv6zQmIDUu0tiMZj:fqq27icQVkVj

Score

10^/10

njrat ju discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

ju

C2

200.163.3.57:6522

Mutex

8a61be64e8caaec4b1b2f68f47e67a8f

Attributes

reg_key
8a61be64e8caaec4b1b2f68f47e67a8f
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  9afb798850a3e6a18a58ee03649cfc63b020502585f27cede5b75754546cabf6
- Size
  
  31KB
- MD5
  
  f3f0ccda18da89e09238baac20aebfe8
- SHA1
  
  be11f524fc269e7f54b699aaaeb98ddbeac0dfc6
- SHA256
  
  9afb798850a3e6a18a58ee03649cfc63b020502585f27cede5b75754546cabf6
- SHA512
  
  639ae3316eb8570f8b67039f7cd4a22811e53b0fbc6599bc98cc1bdbc6202c099ac0ab246a1931699b3f14143293696d338f12643839c05802f3cee0e51fa525
- SSDEEP
  
  768:2hSp69DdxkzxP6bo8SG3FQNv6zQmIDUu0tiMZj:fqq27icQVkVj
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan