njrat | hxxp://njrat download | Triage

Sharing

General

Target

http://njrat download
Sample

241010-kw7ssayakk

Score

10^/10

njrat hacked nigerian discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed nigerian

C2

hakim32.ddns.net:2000

127.0.0.1:5552

Mutex

0836ad3f4f2a3225437e173723805851

Attributes

reg_key
0836ad3f4f2a3225437e173723805851
splitter
|'|'|

Targets

- Target
  
  http://njrat download
Score

10^/10

njrat hacked nigerian discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Executes dropped EXE
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

urlscan1

behavioral1

njrathacked nigeriandiscoveryevasionpersistenceprivilege_escalationtrojan