njrat | de35a1f43c766fb0011acd7aa43b967405db697c4bda37ebf8a08430bebd8670 | Triage

Sharing

General

Target

de35a1f43c766fb0011acd7aa43b967405db697c4bda37ebf8a08430bebd8670N
Size

23KB
Sample

241018-k9yf9syfkg
MD5

0f47552e74da6833f92ccb6494a11000
SHA1

78318c7529456bc962636e45baaf0ecb27b58864
SHA256

de35a1f43c766fb0011acd7aa43b967405db697c4bda37ebf8a08430bebd8670
SHA512

ed1dc550148ef83472cf00a6c23fe66f7b6a98ed6a25b61776d21a76b57842d29e80aa82d67f6c901d7c51dc273a3d5c0cbaf3fd7e951dd58d8776597dccba40
SSDEEP

384:fcqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZR2I:E30py6vhxaRpcnuaD

Score

10^/10

njrat ip discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

IP

C2

diffdns.duckdns.org:11767

Mutex

3287d0b6dfdc541df88eb2a16d9884c6

Attributes

reg_key
3287d0b6dfdc541df88eb2a16d9884c6
splitter
|'|'|

Targets

- Target
  
  de35a1f43c766fb0011acd7aa43b967405db697c4bda37ebf8a08430bebd8670N
- Size
  
  23KB
- MD5
  
  0f47552e74da6833f92ccb6494a11000
- SHA1
  
  78318c7529456bc962636e45baaf0ecb27b58864
- SHA256
  
  de35a1f43c766fb0011acd7aa43b967405db697c4bda37ebf8a08430bebd8670
- SHA512
  
  ed1dc550148ef83472cf00a6c23fe66f7b6a98ed6a25b61776d21a76b57842d29e80aa82d67f6c901d7c51dc273a3d5c0cbaf3fd7e951dd58d8776597dccba40
- SSDEEP
  
  384:fcqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZR2I:E30py6vhxaRpcnuaD
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan