njrat | f1ba75c0f92941abfc289b0f4c8fb8c87eb252402e160076e298e301d246e96f | Triage

Sharing

General

Target

f1ba75c0f92941abfc289b0f4c8fb8c87eb252402e160076e298e301d246e96fN.exe
Size

29KB
Sample

241201-1j2zrsxqgn
MD5

db0c80485ac6c4315ab1bf636c243650
SHA1

31c48451fe369485efbe4a3b809f69245e8ec8d7
SHA256

f1ba75c0f92941abfc289b0f4c8fb8c87eb252402e160076e298e301d246e96f
SHA512

469359fd600df5d1b1aea5b7984b29156e4dc51f668f82ba0f89c8f72abcd8ee1eababbd6643b9236d5658a154b26cac592fc6d762a077db64478567db853650
SSDEEP

384:5hpQjtl7jBnoKoK3JX15nHK4GumqDAEReIlGBsbh0w4wlAokw9OhgOL1vYRGOZzK:527hoKoGJFNK4Aq1RehBKh0p29SgRdo

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

127.0.0.1:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Targets

- Target
  
  f1ba75c0f92941abfc289b0f4c8fb8c87eb252402e160076e298e301d246e96fN.exe
- Size
  
  29KB
- MD5
  
  db0c80485ac6c4315ab1bf636c243650
- SHA1
  
  31c48451fe369485efbe4a3b809f69245e8ec8d7
- SHA256
  
  f1ba75c0f92941abfc289b0f4c8fb8c87eb252402e160076e298e301d246e96f
- SHA512
  
  469359fd600df5d1b1aea5b7984b29156e4dc51f668f82ba0f89c8f72abcd8ee1eababbd6643b9236d5658a154b26cac592fc6d762a077db64478567db853650
- SSDEEP
  
  384:5hpQjtl7jBnoKoK3JX15nHK4GumqDAEReIlGBsbh0w4wlAokw9OhgOL1vYRGOZzK:527hoKoGJFNK4Aq1RehBKh0p29SgRdo
Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

discoveryevasionpersistenceprivilege_escalation