Overview

overview

10

Static

static

10

njRAT-v0.6...AT.exe

windows11-21h2-x64

10

Resubmissions

10-12-2024 13:33

241210-qtg28swqav 10

10-12-2024 13:32

241210-qsxraswphz 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    njRAT-v0.6.4.zip

  • Size

    1.5MB

  • Sample

    241210-qsxraswphz

  • MD5

    3ccce9d87ce9ea751abea094d1639d0a

  • SHA1

    427867b229e02869ac68de3a605998a585ad6a80

  • SHA256

    5ff121c57e4a2f2f75e4985660c9666a44b39ef2549b29b3a4d6a1e06e6e3f65

  • SHA512

    c2b77936b7238582a92d21ff9149e7eeeef65004fc5528148ecbaf9467252dff138ce545fe90bd8c621e82c38b9e0e44f022550e0cc5e5b134e504919142fe8d

  • SSDEEP

    49152:pmRkTADhN5ulDigt8pri+kxs9/z/pH+3h:pmRulu48p2VU/z/S

Score
10/10
njratdiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      njRAT-v0.6.4/njRAT.exe

    • Size

      959KB

    • MD5

      0431311b5f024d6e66b90d59491f2563

    • SHA1

      e9ff4da7e3f2199cbc16d37d8935cb1b0567ac2a

    • SHA256

      fd624aa205517580e83fad7a4ce4d64863e95f62b34ac72647b1974a52822199

    • SHA512

      d44b14e4b24e6e2d506ec32098488a16ebd5df57499ecd85e8878b8af2a3e1f9ed20d4125836417b702d0571f992aeac07af051dbf9268f48954556d17f51ee2

    • SSDEEP

      12288:+O9vE3J7JO+xEPuc//9wivAmv6SAbnzmip2hGnadlFM4ZHOT2:+eXuczPCSGnzVjad1

    Score
    10/10
    njratdiscoveryevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks