njrat | c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814 | Triage

Sharing

General

Target

c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
Size

474KB
Sample

241123-3jd9taymep
MD5

9e8fa72316dbbc6e450cc046acb8e695
SHA1

b63c9a9b7937dd2d943444856e59f9c49b888168
SHA256

c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814
SHA512

f7b7b7b9db2090cc7ac4d09827debe968bf5273611c804713b9650bd363741e3f0fe36cde2ae22d3c6e5337563060233ff3289415774f0788c4790fd9753250a
SSDEEP

3072:rwG1Z6pASc9NyxV9/J12vyNBix94P/+ItEXUrbDn45YfOWIXusP:rwGb6KUFhex94P/+jkvDn45iQee

Score

10^/10

njrat west-k.s.a @evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

WeSt-K.S.A @

C2

127.0.0.1:5551

Mutex

0f436963af986f0915e6f175d79d7302

Attributes

reg_key
0f436963af986f0915e6f175d79d7302
splitter
|'|'|

Targets

- Target
  
  c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814.exe
- Size
  
  474KB
- MD5
  
  9e8fa72316dbbc6e450cc046acb8e695
- SHA1
  
  b63c9a9b7937dd2d943444856e59f9c49b888168
- SHA256
  
  c70b9111798bfa7ff55f89b8d3b0d2dc45b6dd1de23bf236e652403f1be52814
- SHA512
  
  f7b7b7b9db2090cc7ac4d09827debe968bf5273611c804713b9650bd363741e3f0fe36cde2ae22d3c6e5337563060233ff3289415774f0788c4790fd9753250a
- SSDEEP
  
  3072:rwG1Z6pASc9NyxV9/J12vyNBix94P/+ItEXUrbDn45YfOWIXusP:rwGb6KUFhex94P/+jkvDn45iQee
Score

10^/10

njrat west-k.s.a @evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratwest-k.s.a @evasionpersistenceprivilege_escalationtrojan

behavioral2

njratwest-k.s.a @evasionpersistenceprivilege_escalationtrojan