njrat | 45bda8c92e7b4911c253a9bb48789a11b46a34659971fbf0f600c8d51f9cd258 | Triage

Sharing

General

Target

45bda8c92e7b4911c253a9bb48789a11b46a34659971fbf0f600c8d51f9cd258N.exe
Size

39KB
Sample

241207-xy3m3aypbx
MD5

537373fde8a3c534ec04135f5cafc720
SHA1

9dae8d505e7e0df78cc142bab6e08b0816431ad0
SHA256

45bda8c92e7b4911c253a9bb48789a11b46a34659971fbf0f600c8d51f9cd258
SHA512

4984f560442066ef5da1f592e5c2e6ea163d22627cb4e87972e3cd1c315d6b812c23748a4cf76e5f1aa8c94afa9e0e007226981e94a2d358871a9d4a6aa1cf8e
SSDEEP

768:YEv5CfJ9Wdi3EKbVMsA+5otbIMimDhZLPrYBiIVQgzOqn4GNA:YEvsfP3NAec0Mi8nYcIVgqj2

Score

10^/10

njrat evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  45bda8c92e7b4911c253a9bb48789a11b46a34659971fbf0f600c8d51f9cd258N.exe
- Size
  
  39KB
- MD5
  
  537373fde8a3c534ec04135f5cafc720
- SHA1
  
  9dae8d505e7e0df78cc142bab6e08b0816431ad0
- SHA256
  
  45bda8c92e7b4911c253a9bb48789a11b46a34659971fbf0f600c8d51f9cd258
- SHA512
  
  4984f560442066ef5da1f592e5c2e6ea163d22627cb4e87972e3cd1c315d6b812c23748a4cf76e5f1aa8c94afa9e0e007226981e94a2d358871a9d4a6aa1cf8e
- SSDEEP
  
  768:YEv5CfJ9Wdi3EKbVMsA+5otbIMimDhZLPrYBiIVQgzOqn4GNA:YEvsfP3NAec0Mi8nYcIVgqj2
Score

10^/10

njrat evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratevasionpersistenceprivilege_escalationtrojan

behavioral2

njratevasionpersistenceprivilege_escalationtrojan