njrat | c130ea959e49d716170b04de5e49c97d4bee1e54905a33f22fda80afcef1dd73 | Triage

Sharing

General

Target

9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118
Size

389KB
Sample

241125-tp5jhs1phq
MD5

9c9394e5057101a3f4bbc2a643f23c0a
SHA1

f082e9ac2d0854ee09bae455999b08bd917b16a0
SHA256

c130ea959e49d716170b04de5e49c97d4bee1e54905a33f22fda80afcef1dd73
SHA512

5bc10b3fafc08ae316b9d7b510aea36b51238d33e729b4a3c1b428c6a1343f83f392012f081492086b76b903d5fb6f3eeb2a794ed20d1a72340936812dd9a785
SSDEEP

3072:kZ1y+XDKMV0TuSgJMtgtvom7iF44ERt+TLxGW2jKbgX2qBJqhlosmAJeliLIchWJ:kXzfJMtgtvom7e/LsWfbiBUIRAJelUc

Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:7777

Mutex

8ca5518ce78f280e51a1470fffc92c12

Attributes

reg_key
8ca5518ce78f280e51a1470fffc92c12
splitter
|'|'|

Targets

- Target
  
  9c9394e5057101a3f4bbc2a643f23c0a_JaffaCakes118
- Size
  
  389KB
- MD5
  
  9c9394e5057101a3f4bbc2a643f23c0a
- SHA1
  
  f082e9ac2d0854ee09bae455999b08bd917b16a0
- SHA256
  
  c130ea959e49d716170b04de5e49c97d4bee1e54905a33f22fda80afcef1dd73
- SHA512
  
  5bc10b3fafc08ae316b9d7b510aea36b51238d33e729b4a3c1b428c6a1343f83f392012f081492086b76b903d5fb6f3eeb2a794ed20d1a72340936812dd9a785
- SSDEEP
  
  3072:kZ1y+XDKMV0TuSgJMtgtvom7iF44ERt+TLxGW2jKbgX2qBJqhlosmAJeliLIchWJ:kXzfJMtgtvom7e/LsWfbiBUIRAJelUc
Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackedevasionpersistenceprivilege_escalationtrojan

behavioral2

njrathackedevasionpersistenceprivilege_escalationtrojan