njrat | 2cfa5cd046adf57d926061b64dca6d8ba637885ea0a5e0aec11f0b01e8d3153e | Triage

Sharing

General

Target

8b653439517f58d135180ab16effe955_JaffaCakes118
Size

405KB
Sample

241103-n83w5swpbq
MD5

8b653439517f58d135180ab16effe955
SHA1

86772f7366a2c7fdcd0daea423fd70121710900a
SHA256

2cfa5cd046adf57d926061b64dca6d8ba637885ea0a5e0aec11f0b01e8d3153e
SHA512

9c5f054c0af242668197139dd53e64bf23d6285d8ed746a8c5d87a72e3557452b0850fb726a99f3bafe44ac8b93160081a480535c39c63e8a0bd4225319be2f7
SSDEEP

3072:yOVTH9dqOVTH9dphiegXp57ewCmFDoBqMvJDA5ZUEb6Evwoe+wiM1uw+TtWn7fJ+:F95D81ew5V5ZH6Evwoe+wiM1uwIx1f

Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

7b1cba4c2fd49c8ec47f2b8a10ea378a

Attributes

reg_key
7b1cba4c2fd49c8ec47f2b8a10ea378a
splitter
|'|'|

Targets

- Target
  
  8b653439517f58d135180ab16effe955_JaffaCakes118
- Size
  
  405KB
- MD5
  
  8b653439517f58d135180ab16effe955
- SHA1
  
  86772f7366a2c7fdcd0daea423fd70121710900a
- SHA256
  
  2cfa5cd046adf57d926061b64dca6d8ba637885ea0a5e0aec11f0b01e8d3153e
- SHA512
  
  9c5f054c0af242668197139dd53e64bf23d6285d8ed746a8c5d87a72e3557452b0850fb726a99f3bafe44ac8b93160081a480535c39c63e8a0bd4225319be2f7
- SSDEEP
  
  3072:yOVTH9dqOVTH9dphiegXp57ewCmFDoBqMvJDA5ZUEb6Evwoe+wiM1uw+TtWn7fJ+:F95D81ew5V5ZH6Evwoe+wiM1uwIx1f
Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackedevasionpersistenceprivilege_escalationtrojan

behavioral2

njrathackedevasionpersistenceprivilege_escalationtrojan