njrat | dfd7d6ed753ec58f05c27ebc97c41ef7826a4dd518d3ea545e56ef83b0bae58f | Triage

Sharing

General

Target

e29e2a43de1978c3dd5224f84d5a6dc1.exe
Size

37KB
Sample

241104-xntmeavfqf
MD5

e29e2a43de1978c3dd5224f84d5a6dc1
SHA1

99dc6c9892ef2ad54485315158618c108830cf4f
SHA256

dfd7d6ed753ec58f05c27ebc97c41ef7826a4dd518d3ea545e56ef83b0bae58f
SHA512

d0437fbd3caced060a20e3f2c06404e62aff94f3a27994c08bacc6ed71be3a7440b7ff089bdf09443a316add44e08948bc00ae104ab87979e6bed47673add01a
SSDEEP

384:pDKbZ7LsikL9zNf/1uyU7LMvrBs2sfarAF+rMRTyN/0L+EcoinblneHQM3epzXxy:MbBml1lU7LMVFsSrM+rMRa8NufP+t

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

2.tcp.eu.ngrok.io:5552

Mutex

d6bf259c37877b40e758762118c76f69

Attributes

reg_key
d6bf259c37877b40e758762118c76f69
splitter
|'|'|

Targets

- Target
  
  e29e2a43de1978c3dd5224f84d5a6dc1.exe
- Size
  
  37KB
- MD5
  
  e29e2a43de1978c3dd5224f84d5a6dc1
- SHA1
  
  99dc6c9892ef2ad54485315158618c108830cf4f
- SHA256
  
  dfd7d6ed753ec58f05c27ebc97c41ef7826a4dd518d3ea545e56ef83b0bae58f
- SHA512
  
  d0437fbd3caced060a20e3f2c06404e62aff94f3a27994c08bacc6ed71be3a7440b7ff089bdf09443a316add44e08948bc00ae104ab87979e6bed47673add01a
- SSDEEP
  
  384:pDKbZ7LsikL9zNf/1uyU7LMvrBs2sfarAF+rMRTyN/0L+EcoinblneHQM3epzXxy:MbBml1lU7LMVFsSrM+rMRa8NufP+t
Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

discoveryevasionpersistenceprivilege_escalation