njrat | d36ff93c9dd527e80640d23df22f89b42d8122e737e1d2c49423730123711dee | Triage

Sharing

General

Target

d36ff93c9dd527e80640d23df22f89b42d8122e737e1d2c49423730123711dee.exe
Size

23KB
Sample

241128-qkfstaymb1
MD5

95e5c3870eca37058e843dc41daf042e
SHA1

3e3a771c03d9ef0340b91733f870bc26ced1228f
SHA256

d36ff93c9dd527e80640d23df22f89b42d8122e737e1d2c49423730123711dee
SHA512

184f0a0f2ccdb9994d7f58ef322cba39686c56f89bae6846e597db0da5811e368a8f7e8b7acfe7b38a94e074a6b95df4ebac969691c9c016e27e34efff3e86c1
SSDEEP

384:poWSkWHa55BgDVRGipkItzY6vZg36Eh7FpmRvR6JZlbw8hqIusZzZQ7J:+Juk9pHRpcnuFJ

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

Madest 0.7d

Botnet

HacKed

C2

neexileeee.ddns.net:1604

Mutex

ad223c181f76c0d1c9788200b640f54f

Attributes

reg_key
ad223c181f76c0d1c9788200b640f54f
splitter
|'|'|

Targets

- Target
  
  d36ff93c9dd527e80640d23df22f89b42d8122e737e1d2c49423730123711dee.exe
- Size
  
  23KB
- MD5
  
  95e5c3870eca37058e843dc41daf042e
- SHA1
  
  3e3a771c03d9ef0340b91733f870bc26ced1228f
- SHA256
  
  d36ff93c9dd527e80640d23df22f89b42d8122e737e1d2c49423730123711dee
- SHA512
  
  184f0a0f2ccdb9994d7f58ef322cba39686c56f89bae6846e597db0da5811e368a8f7e8b7acfe7b38a94e074a6b95df4ebac969691c9c016e27e34efff3e86c1
- SSDEEP
  
  384:poWSkWHa55BgDVRGipkItzY6vZg36Eh7FpmRvR6JZlbw8hqIusZzZQ7J:+Juk9pHRpcnuFJ
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan