njrat | 49e686db686ea8dc3e3eebd8b35e461f062684de3ca06fc3d8b4664b3f175f62 | Triage

Sharing

General

Target

49e686db686ea8dc3e3eebd8b35e461f062684de3ca06fc3d8b4664b3f175f62
Size

37KB
Sample

241005-zv2byaxekb
MD5

1bcf67c1f8bc98427e91ef1f55b08543
SHA1

5027465199412f584324cdd9b7cfe2cc72a356cd
SHA256

49e686db686ea8dc3e3eebd8b35e461f062684de3ca06fc3d8b4664b3f175f62
SHA512

15048ea869527dc6cafc04f18edc4c77d8e3d160525386db3ff70a3810e61c4822d39e6e505cd6264789acfa9f7bf705b389f7a56833fc0844f8a19b722bf5c8
SSDEEP

384:tLGQqQilwhHeTnMGiyMTl03HOj3YTrrAF+rMRTyN/0L+EcoinblneHQM3epzXPNp:7rSMGxMTl0ejY/rM+rMRa8Nu15t

Score

10^/10

njrat ab discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

AB

C2

gman123.duckdns.org:5552

Mutex

a7dbbfe19f5aa2c19ff5ee9aac621d3e

Attributes

reg_key
a7dbbfe19f5aa2c19ff5ee9aac621d3e
splitter
|'|'|

Targets

- Target
  
  49e686db686ea8dc3e3eebd8b35e461f062684de3ca06fc3d8b4664b3f175f62
- Size
  
  37KB
- MD5
  
  1bcf67c1f8bc98427e91ef1f55b08543
- SHA1
  
  5027465199412f584324cdd9b7cfe2cc72a356cd
- SHA256
  
  49e686db686ea8dc3e3eebd8b35e461f062684de3ca06fc3d8b4664b3f175f62
- SHA512
  
  15048ea869527dc6cafc04f18edc4c77d8e3d160525386db3ff70a3810e61c4822d39e6e505cd6264789acfa9f7bf705b389f7a56833fc0844f8a19b722bf5c8
- SSDEEP
  
  384:tLGQqQilwhHeTnMGiyMTl03HOj3YTrrAF+rMRTyN/0L+EcoinblneHQM3epzXPNp:7rSMGxMTl0ejY/rM+rMRa8Nu15t
Score

10^/10

njrat ab discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratabdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

discoveryevasionpersistenceprivilege_escalation