njrat | ff4bc7221036ee331d8b913f12aec34493c11b6c2655dc15cf4281a6306126ab | Triage

Sharing

General

Target

ff4bc7221036ee331d8b913f12aec34493c11b6c2655dc15cf4281a6306126ab
Size

27KB
Sample

241201-peah6svrbr
MD5

24453759fc86d34383bd0ffc722bbfb5
SHA1

495fa07508f0e79d9ce26f9179285d41303ce402
SHA256

ff4bc7221036ee331d8b913f12aec34493c11b6c2655dc15cf4281a6306126ab
SHA512

aad86f8232a676e1705319f0da2c45a89b533ecf5e8bcbc95d610683247f028b57ae7bf8b791468f6ce9b34962778cec205b48c4612c95c82967bb223ad30db9
SSDEEP

768:wMSHQDF42Ko1dtSHP+ycnzLOhTErXjHc:tB9Ko1b7OBErXj8

Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  ff4bc7221036ee331d8b913f12aec34493c11b6c2655dc15cf4281a6306126ab
- Size
  
  27KB
- MD5
  
  24453759fc86d34383bd0ffc722bbfb5
- SHA1
  
  495fa07508f0e79d9ce26f9179285d41303ce402
- SHA256
  
  ff4bc7221036ee331d8b913f12aec34493c11b6c2655dc15cf4281a6306126ab
- SHA512
  
  aad86f8232a676e1705319f0da2c45a89b533ecf5e8bcbc95d610683247f028b57ae7bf8b791468f6ce9b34962778cec205b48c4612c95c82967bb223ad30db9
- SSDEEP
  
  768:wMSHQDF42Ko1dtSHP+ycnzLOhTErXjHc:tB9Ko1b7OBErXj8
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan