njrat | 863a54fcc0edc46e52df772d40698c5645029ea6031022ea8e19a686245d49c6 | Triage

Sharing

General

Target

863a54fcc0edc46e52df772d40698c5645029ea6031022ea8e19a686245d49c6N.exe
Size

164KB
Sample

241218-e46msssrfz
MD5

865bf3d2eeb62c50359ede787f510100
SHA1

462a1745c2da3d1ae7688a3fda60e441debede32
SHA256

863a54fcc0edc46e52df772d40698c5645029ea6031022ea8e19a686245d49c6
SHA512

6d37e88b08fbff52db3db3b19627f49cdad54082c9b34ad8decb90857ab8318b14764a3ee5e6a4dd96f4e272daf8ebfb79139bc3332d8842368431383932d862
SSDEEP

3072:8w11/wTvYZDDNF90qhRb70L8czxE2YY6q9bLzl6fHMEBuo:8wZD9b70wczSTYh9bAlD

Score

10^/10

njrat discovery persistence trojan

Malware Config

Targets

- Target
  
  863a54fcc0edc46e52df772d40698c5645029ea6031022ea8e19a686245d49c6N.exe
- Size
  
  164KB
- MD5
  
  865bf3d2eeb62c50359ede787f510100
- SHA1
  
  462a1745c2da3d1ae7688a3fda60e441debede32
- SHA256
  
  863a54fcc0edc46e52df772d40698c5645029ea6031022ea8e19a686245d49c6
- SHA512
  
  6d37e88b08fbff52db3db3b19627f49cdad54082c9b34ad8decb90857ab8318b14764a3ee5e6a4dd96f4e272daf8ebfb79139bc3332d8842368431383932d862
- SSDEEP
  
  3072:8w11/wTvYZDDNF90qhRb70L8czxE2YY6q9bLzl6fHMEBuo:8wZD9b70wczSTYh9bAlD
Score

10^/10

njrat discovery persistence trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoverypersistencetrojan

behavioral2

discoverypersistence