njrat | f97c97e89dba7b1eed3a9ec3a1910b9bb3ef89478cdfd2cfed05f4d230f4af54 | Triage

Sharing

General

Target

f97c97e89dba7b1eed3a9ec3a1910b9bb3ef89478cdfd2cfed05f4d230f4af54N.exe
Size

23KB
Sample

241126-x6qy8sslaj
MD5

72b220a7b712587de15786c7b968b1a0
SHA1

e2df2ccc60d1282bc36397b8575ccc8c3183ee72
SHA256

f97c97e89dba7b1eed3a9ec3a1910b9bb3ef89478cdfd2cfed05f4d230f4af54
SHA512

ed787f2e2f5173dfe697e6c2b718df244bf597dbbe1e4b982664748a3dd23651758f3d05d973be94e69e0464a46d8873908a964ce379aa68aedf0e77d0dea24a
SSDEEP

384:poWSkWHa55BgDVRGipkItzY6vZg36Eh7FpmRvR6JZlbw8hqIusZzZQ7:+Juk9pHRpcnuF

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

Madest 0.7d

Botnet

HacKed

C2

neexileeee.ddns.net:1604

Mutex

ad223c181f76c0d1c9788200b640f54f

Attributes

reg_key
ad223c181f76c0d1c9788200b640f54f
splitter
|'|'|

Targets

- Target
  
  f97c97e89dba7b1eed3a9ec3a1910b9bb3ef89478cdfd2cfed05f4d230f4af54N.exe
- Size
  
  23KB
- MD5
  
  72b220a7b712587de15786c7b968b1a0
- SHA1
  
  e2df2ccc60d1282bc36397b8575ccc8c3183ee72
- SHA256
  
  f97c97e89dba7b1eed3a9ec3a1910b9bb3ef89478cdfd2cfed05f4d230f4af54
- SHA512
  
  ed787f2e2f5173dfe697e6c2b718df244bf597dbbe1e4b982664748a3dd23651758f3d05d973be94e69e0464a46d8873908a964ce379aa68aedf0e77d0dea24a
- SSDEEP
  
  384:poWSkWHa55BgDVRGipkItzY6vZg36Eh7FpmRvR6JZlbw8hqIusZzZQ7:+Juk9pHRpcnuF
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan