njrat | 5b0d861ebf19505c916cca1201fb0c5c927415170fbce2474b9292396b1d10fe | Triage

Sharing

General

Target

9679be374eb64ddb5e5a161e28a9c77d_JaffaCakes118
Size

156KB
Sample

241124-w7c84ayqbn
MD5

9679be374eb64ddb5e5a161e28a9c77d
SHA1

520fc875609bd4b476945c60d7b0b147c96cd565
SHA256

5b0d861ebf19505c916cca1201fb0c5c927415170fbce2474b9292396b1d10fe
SHA512

519ea9f6c55c962502aaedfbd317ed56e257ccd06e99493f24cd0ccaf0659458e92c91f595420ff85f845c394791db2e9fadb59a7580805ca445f6ce8269b0fc
SSDEEP

1536:4RRjZ6FOBZLc8Remp9JcFq8goiQpthFlu0Lvng8OMGxOZYtcCXg4yLq732m2g43G:4RD/TKqR8gcrfUMG0CxXgm92bUVRzYu

Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  9679be374eb64ddb5e5a161e28a9c77d_JaffaCakes118
- Size
  
  156KB
- MD5
  
  9679be374eb64ddb5e5a161e28a9c77d
- SHA1
  
  520fc875609bd4b476945c60d7b0b147c96cd565
- SHA256
  
  5b0d861ebf19505c916cca1201fb0c5c927415170fbce2474b9292396b1d10fe
- SHA512
  
  519ea9f6c55c962502aaedfbd317ed56e257ccd06e99493f24cd0ccaf0659458e92c91f595420ff85f845c394791db2e9fadb59a7580805ca445f6ce8269b0fc
- SSDEEP
  
  1536:4RRjZ6FOBZLc8Remp9JcFq8goiQpthFlu0Lvng8OMGxOZYtcCXg4yLq732m2g43G:4RD/TKqR8gcrfUMG0CxXgm92bUVRzYu
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan