njrat | 78f87814abbd390bd7b19d7a5acf1fe238515c8568da2627395e7801c46ee682 | Triage

Sharing

General

Target

78f87814abbd390bd7b19d7a5acf1fe238515c8568da2627395e7801c46ee682N.exe
Size

103KB
Sample

241216-cerq8szlgr
MD5

114b54b965fc5cbabb840eae3ec364d0
SHA1

3d93b3b8b92576a965694bd9c4b3aa4ad7eb2665
SHA256

78f87814abbd390bd7b19d7a5acf1fe238515c8568da2627395e7801c46ee682
SHA512

f35d8b27a7f60d412f37debafef33f21c656fe1883db342906571b0035387a634e45ade7df54f45b90ee581c0133f61f1e8c4e0aee07cc122648bd3d4d0db79d
SSDEEP

3072:U21gmmuo45f724vG63Q77NxYePeGk+xS:zjmuo4R7HZQ7JKKeT

Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

g2016.no-ip.biz:1100

Mutex

6c3b7eded99a7f02b8ee3a6ee1c3ec2f

Attributes

reg_key
6c3b7eded99a7f02b8ee3a6ee1c3ec2f
splitter
|'|'|

Targets

- Target
  
  78f87814abbd390bd7b19d7a5acf1fe238515c8568da2627395e7801c46ee682N.exe
- Size
  
  103KB
- MD5
  
  114b54b965fc5cbabb840eae3ec364d0
- SHA1
  
  3d93b3b8b92576a965694bd9c4b3aa4ad7eb2665
- SHA256
  
  78f87814abbd390bd7b19d7a5acf1fe238515c8568da2627395e7801c46ee682
- SHA512
  
  f35d8b27a7f60d412f37debafef33f21c656fe1883db342906571b0035387a634e45ade7df54f45b90ee581c0133f61f1e8c4e0aee07cc122648bd3d4d0db79d
- SSDEEP
  
  3072:U21gmmuo45f724vG63Q77NxYePeGk+xS:zjmuo4R7HZQ7JKKeT
Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackedevasionpersistenceprivilege_escalationtrojan

behavioral2

njrathackedevasionpersistenceprivilege_escalationtrojan