njrat | 6cb9455b415038c5fe7e6d86677f3751033b0478f7264a171cc7a277ad3b706c | Triage

Sharing

General

Target

6cb9455b415038c5fe7e6d86677f3751033b0478f7264a171cc7a277ad3b706c
Size

31KB
Sample

241217-1kj6caynfy
MD5

63f444ed65088c9e278ec2e6892899a6
SHA1

588c5ca8e39578b9341f7cbaa7bec05af51566c4
SHA256

6cb9455b415038c5fe7e6d86677f3751033b0478f7264a171cc7a277ad3b706c
SHA512

1859caf0ba1c328142c8910f4504aea0096d55dac286809ae161c827558f60875f76d5840e469644092ecd05891de5da7ef0f492f50f47d8279dd86704a69567
SSDEEP

768:1qmqnf1Ll58zx36DLeo0HbFZv8NQmIDUu0tihUBj:0B9q/JvsQVk5j

Score

10^/10

njrat mybot discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MyBot

C2

194.163.139.18:1

Mutex

b82d5bda4db4b3ae8f54987579a15212

Attributes

reg_key
b82d5bda4db4b3ae8f54987579a15212
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  6cb9455b415038c5fe7e6d86677f3751033b0478f7264a171cc7a277ad3b706c
- Size
  
  31KB
- MD5
  
  63f444ed65088c9e278ec2e6892899a6
- SHA1
  
  588c5ca8e39578b9341f7cbaa7bec05af51566c4
- SHA256
  
  6cb9455b415038c5fe7e6d86677f3751033b0478f7264a171cc7a277ad3b706c
- SHA512
  
  1859caf0ba1c328142c8910f4504aea0096d55dac286809ae161c827558f60875f76d5840e469644092ecd05891de5da7ef0f492f50f47d8279dd86704a69567
- SSDEEP
  
  768:1qmqnf1Ll58zx36DLeo0HbFZv8NQmIDUu0tihUBj:0B9q/JvsQVk5j
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan