njrat | c6c88e272418531723ae53131975349a647112066a29b20566653e06dca6126c | Triage

Sharing

General

Target

Client.exe
Size

31KB
Sample

241007-ebenlsxgmc
MD5

323cd2c2fe2d5ccbce77e3c0690e6c86
SHA1

5bdac9cc8a576837673704c2b1b1110a5c8a584f
SHA256

c6c88e272418531723ae53131975349a647112066a29b20566653e06dca6126c
SHA512

213c50dfb282e13f86842105cfbdcbe450f5f7773bdb9d25e798177f4dba52196f1da01ddf859fd091a752ee26d320cc0976a3089b20ce59723e96134c8fcfc3
SSDEEP

768:BzorDp8pdvXyzx9uFwna/5nW3TvanQmIDUu0tiE1j:yw68nQbkQVk5j

Score

10^/10

njrat mybot discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

C2

10.0.0.152:6522

Mutex

5fc24bd1ac9d86ed812b76d46107bdc4

Attributes

reg_key
5fc24bd1ac9d86ed812b76d46107bdc4
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  Client.exe
- Size
  
  31KB
- MD5
  
  323cd2c2fe2d5ccbce77e3c0690e6c86
- SHA1
  
  5bdac9cc8a576837673704c2b1b1110a5c8a584f
- SHA256
  
  c6c88e272418531723ae53131975349a647112066a29b20566653e06dca6126c
- SHA512
  
  213c50dfb282e13f86842105cfbdcbe450f5f7773bdb9d25e798177f4dba52196f1da01ddf859fd091a752ee26d320cc0976a3089b20ce59723e96134c8fcfc3
- SSDEEP
  
  768:BzorDp8pdvXyzx9uFwna/5nW3TvanQmIDUu0tiE1j:yw68nQbkQVk5j
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan