njrat | a2f3108c3c2c32f1b9ae75f694d1ee15a2647b2ce3d65f6df9bccaf426fb7af1 | Triage

Sharing

General

Target

a2f3108c3c2c32f1b9ae75f694d1ee15a2647b2ce3d65f6df9bccaf426fb7af1.exe
Size

31KB
Sample

241006-m8fwyavfjb
MD5

f1ffbad1441a7f3368c551402e04fa03
SHA1

73a33bf9e4a2cde9a8468a2eed78f9eae3bb5e54
SHA256

a2f3108c3c2c32f1b9ae75f694d1ee15a2647b2ce3d65f6df9bccaf426fb7af1
SHA512

0b4b7a93d8c7711abae6f5f271f566d0c3a0631749cd7e1050be233131f4d9f9e3ccecfd94ab3c17ee12d7bbad8969f0b5fe6a9179c0bcf61f201d99c504f052
SSDEEP

768:bis2ZOVvZVYzxDCPIAT+vCQEpvywHQmIDUu0tizgj:c+6qJQ6DQVk5j

Score

10^/10

njrat deme discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

deme

C2

192.168.1.34:4444

Mutex

4a511581dfdc310e4c48feb89e0695f4

Attributes

reg_key
4a511581dfdc310e4c48feb89e0695f4
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  a2f3108c3c2c32f1b9ae75f694d1ee15a2647b2ce3d65f6df9bccaf426fb7af1.exe
- Size
  
  31KB
- MD5
  
  f1ffbad1441a7f3368c551402e04fa03
- SHA1
  
  73a33bf9e4a2cde9a8468a2eed78f9eae3bb5e54
- SHA256
  
  a2f3108c3c2c32f1b9ae75f694d1ee15a2647b2ce3d65f6df9bccaf426fb7af1
- SHA512
  
  0b4b7a93d8c7711abae6f5f271f566d0c3a0631749cd7e1050be233131f4d9f9e3ccecfd94ab3c17ee12d7bbad8969f0b5fe6a9179c0bcf61f201d99c504f052
- SSDEEP
  
  768:bis2ZOVvZVYzxDCPIAT+vCQEpvywHQmIDUu0tizgj:c+6qJQ6DQVk5j
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan