njrat | cdccbaf582af4562cf1bc0b9af17cb1970b016978862b9783b72d63e0b978737 | Triage

Sharing

General

Target

cdccbaf582af4562cf1bc0b9af17cb1970b016978862b9783b72d63e0b978737N
Size

23KB
Sample

241017-2kkybatfkk
MD5

9c65466b26aea00831dd162e95d55a80
SHA1

dcc9a0dddabd3bfd28aa9ea406d1557f41619edf
SHA256

cdccbaf582af4562cf1bc0b9af17cb1970b016978862b9783b72d63e0b978737
SHA512

380c8c792f79a2d5f7c8c16200b3144cda8b66a7dd7467a38d4e89f21ec26c917574cd6558147d3ea9bac11412050dd31c1a80a1c7e6fcf997afac5b73247056
SSDEEP

384:Fc6CqbFYh3odrVCGiHssDB4b6i6fgpEupNXRmRvR6JZlbw8hqIusZzZqL:GIU0tw3RpcnuD

Score

10^/10

njrat ratted discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Ratted

C2

labas.ddns.net:5552

Mutex

d85c21748ee7a360202bc148e9065c2e

Attributes

reg_key
d85c21748ee7a360202bc148e9065c2e
splitter
|'|'|

Targets

- Target
  
  cdccbaf582af4562cf1bc0b9af17cb1970b016978862b9783b72d63e0b978737N
- Size
  
  23KB
- MD5
  
  9c65466b26aea00831dd162e95d55a80
- SHA1
  
  dcc9a0dddabd3bfd28aa9ea406d1557f41619edf
- SHA256
  
  cdccbaf582af4562cf1bc0b9af17cb1970b016978862b9783b72d63e0b978737
- SHA512
  
  380c8c792f79a2d5f7c8c16200b3144cda8b66a7dd7467a38d4e89f21ec26c917574cd6558147d3ea9bac11412050dd31c1a80a1c7e6fcf997afac5b73247056
- SSDEEP
  
  384:Fc6CqbFYh3odrVCGiHssDB4b6i6fgpEupNXRmRvR6JZlbw8hqIusZzZqL:GIU0tw3RpcnuD
Score

10^/10

njrat ratted discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratratteddiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan