Overview

overview

10

Static

static

10

njRAT-v0.6.4.zip

windows11-21h2-x64

10

Resubmissions

10-12-2024 13:33

241210-qtg28swqav 10

10-12-2024 13:32

241210-qsxraswphz 10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    njRAT-v0.6.4.zip

  • Size

    1.5MB

  • Sample

    241210-qtg28swqav

  • MD5

    3ccce9d87ce9ea751abea094d1639d0a

  • SHA1

    427867b229e02869ac68de3a605998a585ad6a80

  • SHA256

    5ff121c57e4a2f2f75e4985660c9666a44b39ef2549b29b3a4d6a1e06e6e3f65

  • SHA512

    c2b77936b7238582a92d21ff9149e7eeeef65004fc5528148ecbaf9467252dff138ce545fe90bd8c621e82c38b9e0e44f022550e0cc5e5b134e504919142fe8d

  • SSDEEP

    49152:pmRkTADhN5ulDigt8pri+kxs9/z/pH+3h:pmRulu48p2VU/z/S

Score
10/10
njratdiscoveryevasionpersistenceprivilege_escalationtrojan

Malware Config

Targets

    • Target

      njRAT-v0.6.4.zip

    • Size

      1.5MB

    • MD5

      3ccce9d87ce9ea751abea094d1639d0a

    • SHA1

      427867b229e02869ac68de3a605998a585ad6a80

    • SHA256

      5ff121c57e4a2f2f75e4985660c9666a44b39ef2549b29b3a4d6a1e06e6e3f65

    • SHA512

      c2b77936b7238582a92d21ff9149e7eeeef65004fc5528148ecbaf9467252dff138ce545fe90bd8c621e82c38b9e0e44f022550e0cc5e5b134e504919142fe8d

    • SSDEEP

      49152:pmRkTADhN5ulDigt8pri+kxs9/z/pH+3h:pmRulu48p2VU/z/S

    Score
    10/10
    njratdiscoveryevasionpersistenceprivilege_escalationtrojan

    • Njrat family

      njrat

    • njRAT/Bladabindi

      Widely used RAT written in .NET.

      trojannjrat

    • Modifies Windows Firewall

      evasion

    • Drops startup file

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Event Triggered Execution

1
T1546

Netsh Helper DLL

1
T1546.007

Defense Evasion

Impair Defenses

1
T1562

Disable or Modify System Firewall

1
T1562.004

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks