njrat | 3169e0563d59a768e311fc4efe6f00b5b2e9cef0645db9e5fb355acf0be0db04 | Triage

Sharing

General

Target

d604c8541752e8b63545d5d19c296a7f_JaffaCakes118
Size

872KB
Sample

241208-jtl8maxpfz
MD5

d604c8541752e8b63545d5d19c296a7f
SHA1

fe831e9adc2ca7adf7b5541e1bd8c78324dde120
SHA256

3169e0563d59a768e311fc4efe6f00b5b2e9cef0645db9e5fb355acf0be0db04
SHA512

97d1c9f217d9915d273600792012bc80b03788000d557dd2dd0af0f320fc675565e5060eba31bb1300ec6a9f96c84e7fc86202fbee15157c2abff75b64507457
SSDEEP

12288:BPNMuUFfiGAZD6gZ6Evwoe+wiMsGnfYNDDR11Tyfe/OVB7JuMMBKwss:B1MvKWgk

Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

doza122.con-ip.com:5552

Mutex

68a4a42151e9c45f922a140954d9441d

Attributes

reg_key
68a4a42151e9c45f922a140954d9441d
splitter
|'|'|

Targets

- Target
  
  d604c8541752e8b63545d5d19c296a7f_JaffaCakes118
- Size
  
  872KB
- MD5
  
  d604c8541752e8b63545d5d19c296a7f
- SHA1
  
  fe831e9adc2ca7adf7b5541e1bd8c78324dde120
- SHA256
  
  3169e0563d59a768e311fc4efe6f00b5b2e9cef0645db9e5fb355acf0be0db04
- SHA512
  
  97d1c9f217d9915d273600792012bc80b03788000d557dd2dd0af0f320fc675565e5060eba31bb1300ec6a9f96c84e7fc86202fbee15157c2abff75b64507457
- SSDEEP
  
  12288:BPNMuUFfiGAZD6gZ6Evwoe+wiMsGnfYNDDR11Tyfe/OVB7JuMMBKwss:B1MvKWgk
Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackedevasionpersistenceprivilege_escalationtrojan

behavioral2

njrathackedevasionpersistenceprivilege_escalationtrojan