njrat | 71b021e97308b5db38564b6794e30c44886aa10aa2e6c91f61f3a647076146a7 | Triage

Sharing

General

Target

NjRat Lime Edition 0.8.0.exe
Size

165KB
Sample

241011-saavxsxhqe
MD5

3fffdf6d0b0d6305060008ff4b67ab3c
SHA1

48f1b88a58f69689fa0f155d21d1629cd689a7e2
SHA256

71b021e97308b5db38564b6794e30c44886aa10aa2e6c91f61f3a647076146a7
SHA512

c1c1267074596d51ae076d9667513f0dbf424c327fd1558d4e2d1dbcea18fdbae8a72fe7fc98215d3e021f0c624ce496b6bb958979396ad049a777d91a4d8458
SSDEEP

3072:CRd8w/fFvqnA1Q/p3fOKNIjrNxztk8wEEgIl6562ubkXmLrN+:CRdrQRvp+Nxztk8DEZl5bjrN+

Score

10^/10

njrat discovery persistence trojan

Malware Config

Targets

- Target
  
  NjRat Lime Edition 0.8.0.exe
- Size
  
  165KB
- MD5
  
  3fffdf6d0b0d6305060008ff4b67ab3c
- SHA1
  
  48f1b88a58f69689fa0f155d21d1629cd689a7e2
- SHA256
  
  71b021e97308b5db38564b6794e30c44886aa10aa2e6c91f61f3a647076146a7
- SHA512
  
  c1c1267074596d51ae076d9667513f0dbf424c327fd1558d4e2d1dbcea18fdbae8a72fe7fc98215d3e021f0c624ce496b6bb958979396ad049a777d91a4d8458
- SSDEEP
  
  3072:CRd8w/fFvqnA1Q/p3fOKNIjrNxztk8wEEgIl6562ubkXmLrN+:CRdrQRvp+Nxztk8DEZl5bjrN+
Score

10^/10

njrat discovery persistence trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoverypersistencetrojan