njrat | 10071b7fc8c1800063e60780b8c00b3c0045feecdb92e08ac45cc057127193dc | Triage

Sharing

General

Target

10071b7fc8c1800063e60780b8c00b3c0045feecdb92e08ac45cc057127193dc.exe
Size

23KB
Sample

241006-npys3swekd
MD5

b86e2528a9d9751d2bf3f989cb4268ea
SHA1

5605831e837335df40d011f101179cb9c0484580
SHA256

10071b7fc8c1800063e60780b8c00b3c0045feecdb92e08ac45cc057127193dc
SHA512

45724514526b04540ef9fb8301c97cc968e53440324ba61723845691f3ef6e96a34103d24e41aa39955e5dc3a15fce54126339b5867779cc727c835b17e16d2e
SSDEEP

384:DqMKyOkBkRbohza8yuTUt7u06zgV4a5pzomRvR6JZlbw8hqIusZzZHW:B/YI1T0RpcnuZ

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

192.168.1.5:666

Mutex

e8b7e12b68af78ab5a48ce21dc298649

Attributes

reg_key
e8b7e12b68af78ab5a48ce21dc298649
splitter
@!#&^%$

Targets

- Target
  
  10071b7fc8c1800063e60780b8c00b3c0045feecdb92e08ac45cc057127193dc.exe
- Size
  
  23KB
- MD5
  
  b86e2528a9d9751d2bf3f989cb4268ea
- SHA1
  
  5605831e837335df40d011f101179cb9c0484580
- SHA256
  
  10071b7fc8c1800063e60780b8c00b3c0045feecdb92e08ac45cc057127193dc
- SHA512
  
  45724514526b04540ef9fb8301c97cc968e53440324ba61723845691f3ef6e96a34103d24e41aa39955e5dc3a15fce54126339b5867779cc727c835b17e16d2e
- SSDEEP
  
  384:DqMKyOkBkRbohza8yuTUt7u06zgV4a5pzomRvR6JZlbw8hqIusZzZHW:B/YI1T0RpcnuZ
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan