njrat | a78f3743cd22750600d9e73ad8678ee43b9eaa8cbce0efb27858b1dd0ab14e59 | Triage

Sharing

General

Target

a78f3743cd22750600d9e73ad8678ee43b9eaa8cbce0efb27858b1dd0ab14e59N
Size

93KB
Sample

241110-l1m5lsxpcq
MD5

b9777e6821659e565e88106afe2aaeb0
SHA1

fa4eadcbcf3b771bb02a24275a1a961f7a6eb253
SHA256

a78f3743cd22750600d9e73ad8678ee43b9eaa8cbce0efb27858b1dd0ab14e59
SHA512

2335abc6f07eff5312d17c63fed9bac9bcca1b16486e56fabe2945c79d5fc3f9644a99c3a1f48b53fa02ef691bb678cc29c062a51657617c21b71d412d20ef0c
SSDEEP

768:dY3GUfhWXxyFcxovUKUJuROprXtWN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3XsGdpTgM:RU5WhIUKcuOJhPhBjEwzGi1dDDDTgS

Score

10^/10

njrat skibidi discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

skibidi

C2

hakim32.ddns.net:2000

127.0.0.1:8848

Mutex

642760713eaf9ba9d83af2740513d99b

Attributes

reg_key
642760713eaf9ba9d83af2740513d99b
splitter
|'|'|

Targets

- Target
  
  a78f3743cd22750600d9e73ad8678ee43b9eaa8cbce0efb27858b1dd0ab14e59N
- Size
  
  93KB
- MD5
  
  b9777e6821659e565e88106afe2aaeb0
- SHA1
  
  fa4eadcbcf3b771bb02a24275a1a961f7a6eb253
- SHA256
  
  a78f3743cd22750600d9e73ad8678ee43b9eaa8cbce0efb27858b1dd0ab14e59
- SHA512
  
  2335abc6f07eff5312d17c63fed9bac9bcca1b16486e56fabe2945c79d5fc3f9644a99c3a1f48b53fa02ef691bb678cc29c062a51657617c21b71d412d20ef0c
- SSDEEP
  
  768:dY3GUfhWXxyFcxovUKUJuROprXtWN8eYhYbmXxrjEtCdnl2pi1Rz4Rk3XsGdpTgM:RU5WhIUKcuOJhPhBjEwzGi1dDDDTgS
Score

10^/10

njrat skibidi discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratskibididiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

discoveryevasionpersistenceprivilege_escalation