njrat | 3b4ef31c1496f462a72de7f8328a6d6d8b735e95105365d995c0d67762937310 | Triage

Sharing

General

Target

3b4ef31c1496f462a72de7f8328a6d6d8b735e95105365d995c0d67762937310N.exe
Size

23KB
Sample

241216-crcsvaynfs
MD5

85f3632ec0d68eb2f86ef3296035fe20
SHA1

3d92844f5ee15a1bdf666e7319188cc259454148
SHA256

3b4ef31c1496f462a72de7f8328a6d6d8b735e95105365d995c0d67762937310
SHA512

b65ff6a7982b70ee00bca2bf716ce4ccbdad5df8f34edb3727c9eb79cb30163ec8f5c3ae193a6165460c6173f30930bbcf382e101d539779a160daaee7c6ee03
SSDEEP

384:XMK6b2GZsx/Yr1+liORH1kcPFQ6Lg9gSOYRr9mRvR6JZlbw8hqIusZzZIyk:wb9glF51LRpcnu9

Score

10^/10

njrat port discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

port

C2

gsons-ksa.no-ip.biz:1177

Mutex

8ddcc9511ea46928c6c4aa56d52fdc3b

Attributes

reg_key
8ddcc9511ea46928c6c4aa56d52fdc3b
splitter
|'|'|

Targets

- Target
  
  3b4ef31c1496f462a72de7f8328a6d6d8b735e95105365d995c0d67762937310N.exe
- Size
  
  23KB
- MD5
  
  85f3632ec0d68eb2f86ef3296035fe20
- SHA1
  
  3d92844f5ee15a1bdf666e7319188cc259454148
- SHA256
  
  3b4ef31c1496f462a72de7f8328a6d6d8b735e95105365d995c0d67762937310
- SHA512
  
  b65ff6a7982b70ee00bca2bf716ce4ccbdad5df8f34edb3727c9eb79cb30163ec8f5c3ae193a6165460c6173f30930bbcf382e101d539779a160daaee7c6ee03
- SSDEEP
  
  384:XMK6b2GZsx/Yr1+liORH1kcPFQ6Lg9gSOYRr9mRvR6JZlbw8hqIusZzZIyk:wb9glF51LRpcnu9
Score

10^/10

njrat port discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratportdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan