njrat | 7812344ebb0aed20fb8cd932ad7c7c019dccb813956a1a5dd9f94bf6af82d50a | Triage

Sharing

General

Target

7812344ebb0aed20fb8cd932ad7c7c019dccb813956a1a5dd9f94bf6af82d50a.exe
Size

31KB
Sample

241217-dxqsbsypcx
MD5

a2d2fc6108063a466264a34e7c46c8a3
SHA1

ddab38e1dcf749d355bf63a0eb25ce844db1d880
SHA256

7812344ebb0aed20fb8cd932ad7c7c019dccb813956a1a5dd9f94bf6af82d50a
SHA512

2d34d5c75f2cdad94fa957c80d71f697b2fb9bd949e25d9035234c9c7a37f00fd8d92b3e7c17c84a2a65b9b4893f1336850722e4111244f2d70e0cc1eaa44145
SSDEEP

768:gjMXjwpJbb2zxxO56eqvPisfv8yQmIDUu0tiX7j:3kKdisvQVk+j

Score

10^/10

njrat enai discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Enai

C2

6.tcp.eu.ngrok.io:14377

Mutex

bd898fbb4a2356e019689e2e64340d76

Attributes

reg_key
bd898fbb4a2356e019689e2e64340d76
splitter
Y262SUCZ4UJJ

Targets

- Target
  
  7812344ebb0aed20fb8cd932ad7c7c019dccb813956a1a5dd9f94bf6af82d50a.exe
- Size
  
  31KB
- MD5
  
  a2d2fc6108063a466264a34e7c46c8a3
- SHA1
  
  ddab38e1dcf749d355bf63a0eb25ce844db1d880
- SHA256
  
  7812344ebb0aed20fb8cd932ad7c7c019dccb813956a1a5dd9f94bf6af82d50a
- SHA512
  
  2d34d5c75f2cdad94fa957c80d71f697b2fb9bd949e25d9035234c9c7a37f00fd8d92b3e7c17c84a2a65b9b4893f1336850722e4111244f2d70e0cc1eaa44145
- SSDEEP
  
  768:gjMXjwpJbb2zxxO56eqvPisfv8yQmIDUu0tiX7j:3kKdisvQVk+j
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan