njrat | f93f248afa497a39791236e4077a99e1bc8d09b2a00c53e7c4abf1a02a81b08a | Triage

Sharing

General

Target

f93f248afa497a39791236e4077a99e1bc8d09b2a00c53e7c4abf1a02a81b08a
Size

23KB
Sample

241019-fta9ksyfra
MD5

ff281fc96b0c1119583c71801a33fde3
SHA1

c4e751a41373bda44b146f63d8c67bbe4cc78d7e
SHA256

f93f248afa497a39791236e4077a99e1bc8d09b2a00c53e7c4abf1a02a81b08a
SHA512

4523cd54503e93113c74117d3c632390abcfb92bd5f69a9fa57686a0f059b59de2d793192aa9cb7000f9fef6811023317d2deb3fe90ecea3dbc8bf62215ae0e7
SSDEEP

384:RY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZuS:mL2s+tRyRpcnuS

Score

10^/10

njrat mohib discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

mohib

C2

127.0.0.1:1978

Mutex

a0b72362103f09d1b009d939c194f0ce

Attributes

reg_key
a0b72362103f09d1b009d939c194f0ce
splitter
|'|'|

Targets

- Target
  
  f93f248afa497a39791236e4077a99e1bc8d09b2a00c53e7c4abf1a02a81b08a
- Size
  
  23KB
- MD5
  
  ff281fc96b0c1119583c71801a33fde3
- SHA1
  
  c4e751a41373bda44b146f63d8c67bbe4cc78d7e
- SHA256
  
  f93f248afa497a39791236e4077a99e1bc8d09b2a00c53e7c4abf1a02a81b08a
- SHA512
  
  4523cd54503e93113c74117d3c632390abcfb92bd5f69a9fa57686a0f059b59de2d793192aa9cb7000f9fef6811023317d2deb3fe90ecea3dbc8bf62215ae0e7
- SSDEEP
  
  384:RY324bcgPiJLQrfARGSRUJsbY6ZgvSMBD3t8mRvR6JZlbw8hqIusZzZuS:mL2s+tRyRpcnuS
Score

10^/10

njrat mohib discovery evasion persistence privilege_escalation trojan
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratmohibdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan