njrat | ccaa9f9e4a61111b9814917dcb9703768743dffc8faec938bc480c7b091c33dc | Triage

Sharing

General

Target

ccaa9f9e4a61111b9814917dcb9703768743dffc8faec938bc480c7b091c33dc.exe
Size

31KB
Sample

241119-gmavxa1kes
MD5

22c54abbde95e1f240a8a65343e6faa9
SHA1

8f6727a8ea3977e1f5fbea78c1390d6cc8a1b36a
SHA256

ccaa9f9e4a61111b9814917dcb9703768743dffc8faec938bc480c7b091c33dc
SHA512

86ab53c341cc671e6b8d57bcb12a1f4337e6d36f5586480ec4a90234d73780626020582ea72c9a381392d0f54d6fa9a0f03b0f3d83b32c97c227899e9f40e171
SSDEEP

768:8J8R5d5rLmzxBuJRSae8H5LPvyQQmIDUu0tiroj:DvKmpj3QVktj

Score

10^/10

njrat mpg discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MPG

C2

49.228.131.165:2422

Mutex

fa6b40864b6c109adbc85023cd1f59d2

Attributes

reg_key
fa6b40864b6c109adbc85023cd1f59d2
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  ccaa9f9e4a61111b9814917dcb9703768743dffc8faec938bc480c7b091c33dc.exe
- Size
  
  31KB
- MD5
  
  22c54abbde95e1f240a8a65343e6faa9
- SHA1
  
  8f6727a8ea3977e1f5fbea78c1390d6cc8a1b36a
- SHA256
  
  ccaa9f9e4a61111b9814917dcb9703768743dffc8faec938bc480c7b091c33dc
- SHA512
  
  86ab53c341cc671e6b8d57bcb12a1f4337e6d36f5586480ec4a90234d73780626020582ea72c9a381392d0f54d6fa9a0f03b0f3d83b32c97c227899e9f40e171
- SSDEEP
  
  768:8J8R5d5rLmzxBuJRSae8H5LPvyQQmIDUu0tiroj:DvKmpj3QVktj
Score

10^/10

njrat mpg discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratmpgdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratmpgdiscoveryevasionpersistenceprivilege_escalationtrojan