njrat | 4eeadc61cea86431c54b31d10e62d889d82bc63efac9b9fc2449bc1f64257901 | Triage

Sharing

General

Target

4eeadc61cea86431c54b31d10e62d889d82bc63efac9b9fc2449bc1f64257901.exe
Size

31KB
Sample

241119-v57t9ayeqe
MD5

6a77c77a011db46d357e48cbb4b34a20
SHA1

3ceed55bb359214b8d27650249f1530d7935367a
SHA256

4eeadc61cea86431c54b31d10e62d889d82bc63efac9b9fc2449bc1f64257901
SHA512

af14e4f14202b79c0c8175a5d5cacb3b550eba541b3832342f07f3cd6cf48fa50317edbd8749a6df43937939a3b607cff18684f84a7a301165fd1725b8a01d7a
SSDEEP

768:8J8R5d5rLmzxBuJRSae8H5LPvyQQmIDUu0tirojL:DvKmpj3QVktjL

Score

10^/10

njrat mpg discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MPG

C2

49.228.131.165:2422

Mutex

fa6b40864b6c109adbc85023cd1f59d2

Attributes

reg_key
fa6b40864b6c109adbc85023cd1f59d2
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  4eeadc61cea86431c54b31d10e62d889d82bc63efac9b9fc2449bc1f64257901.exe
- Size
  
  31KB
- MD5
  
  6a77c77a011db46d357e48cbb4b34a20
- SHA1
  
  3ceed55bb359214b8d27650249f1530d7935367a
- SHA256
  
  4eeadc61cea86431c54b31d10e62d889d82bc63efac9b9fc2449bc1f64257901
- SHA512
  
  af14e4f14202b79c0c8175a5d5cacb3b550eba541b3832342f07f3cd6cf48fa50317edbd8749a6df43937939a3b607cff18684f84a7a301165fd1725b8a01d7a
- SSDEEP
  
  768:8J8R5d5rLmzxBuJRSae8H5LPvyQQmIDUu0tirojL:DvKmpj3QVktjL
Score

10^/10

njrat mpg discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratmpgdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratmpgdiscoveryevasionpersistenceprivilege_escalationtrojan