njrat | b7f5245002784627da1996be95b0e18abd73df0da01cbb268e39c5d39f04f4e8 | Triage

Sharing

General

Target

558d83545b3096f901e84dd00bccd9e8_JaffaCakes118
Size

23KB
Sample

241018-fe5vms1dmm
MD5

558d83545b3096f901e84dd00bccd9e8
SHA1

f8a62eb35a55307eaea56a4d689b1d9e68e303ea
SHA256

b7f5245002784627da1996be95b0e18abd73df0da01cbb268e39c5d39f04f4e8
SHA512

af4bcdb32071d2aef39fbe71f54466af07eb788ba9494af7f7937c93ac77cf341465bb733a0ba587f12606dc4c114d81293ae287f2041c8df0c3539bb3ce857d
SSDEEP

384:3reop9oS+2pRURIXIRHVSuV+MX9w6Vglo61ZhXDVmRvR6JZlbw8hqIusZzZwe:3Sof9pnIP1V6YRpcnuA

Score

10^/10

njrat coooooin discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

COOOOOin

C2

facebook-sports.publicvm.com:1643

Mutex

c594020b32b858bc072fb76065d697d0

Attributes

reg_key
c594020b32b858bc072fb76065d697d0
splitter
|'|'|

Targets

- Target
  
  558d83545b3096f901e84dd00bccd9e8_JaffaCakes118
- Size
  
  23KB
- MD5
  
  558d83545b3096f901e84dd00bccd9e8
- SHA1
  
  f8a62eb35a55307eaea56a4d689b1d9e68e303ea
- SHA256
  
  b7f5245002784627da1996be95b0e18abd73df0da01cbb268e39c5d39f04f4e8
- SHA512
  
  af4bcdb32071d2aef39fbe71f54466af07eb788ba9494af7f7937c93ac77cf341465bb733a0ba587f12606dc4c114d81293ae287f2041c8df0c3539bb3ce857d
- SSDEEP
  
  384:3reop9oS+2pRURIXIRHVSuV+MX9w6Vglo61ZhXDVmRvR6JZlbw8hqIusZzZwe:3Sof9pnIP1V6YRpcnuA
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan