njrat | eadc94ee009fee95cff7173b0ee720ed4359253bce2e175aa860a5c4d4aec808 | Triage

Sharing

General

Target

eadc94ee009fee95cff7173b0ee720ed4359253bce2e175aa860a5c4d4aec808N.exe
Size

23KB
Sample

241206-jwprjaxnbs
MD5

16927d3390d4f23cde3f65db53a00030
SHA1

7596cb727577efd1d71ffdf8ba2197e9ef72dfc6
SHA256

eadc94ee009fee95cff7173b0ee720ed4359253bce2e175aa860a5c4d4aec808
SHA512

a91376db8554d7537604ab8b80a76cc7b1879c477caf2787cb2c1ecc22ca95246a680712f7fef056969ea43daef638dfc835fb0d2481df69bb6afa4045b1e12c
SSDEEP

384:TluBPiZCMfdfSJrQbsLRGSIxYVL46pg/i8BD9BmRvR6JZlbw8hqIusZzZg61:8OmhtIiRpcnuf6

Score

10^/10

njrat lammer discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Lammer

C2

bielserver.duckdns.org:7778

Mutex

6c26bb082e8cb4ff278e1067d3256202

Attributes

reg_key
6c26bb082e8cb4ff278e1067d3256202
splitter
|'|'|

Targets

- Target
  
  eadc94ee009fee95cff7173b0ee720ed4359253bce2e175aa860a5c4d4aec808N.exe
- Size
  
  23KB
- MD5
  
  16927d3390d4f23cde3f65db53a00030
- SHA1
  
  7596cb727577efd1d71ffdf8ba2197e9ef72dfc6
- SHA256
  
  eadc94ee009fee95cff7173b0ee720ed4359253bce2e175aa860a5c4d4aec808
- SHA512
  
  a91376db8554d7537604ab8b80a76cc7b1879c477caf2787cb2c1ecc22ca95246a680712f7fef056969ea43daef638dfc835fb0d2481df69bb6afa4045b1e12c
- SSDEEP
  
  384:TluBPiZCMfdfSJrQbsLRGSIxYVL46pg/i8BD9BmRvR6JZlbw8hqIusZzZg61:8OmhtIiRpcnuf6
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan