njrat | 56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f | Triage

Sharing

General

Target

56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe
Size

164KB
Sample

241218-mja96awnfr
MD5

1ebb888eb774b33e4f91d7dad2c00737
SHA1

f272c1a38563aa52d40dad5234ec3a5284768e26
SHA256

56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f
SHA512

beb867449918c2ace20abf0b92654c6eee5bca74dc4af8053cb31f838775e96350e40c4a6ea7067d24c4f53b5b767d6e343623ef8faa37847165c82a00cff1c6
SSDEEP

3072:8w11/wTvYZDDNF90qhRb70L8czxE2YY6q9bLzl6fHMEBuo3:8wZD9b70wczSTYh9bAlD3

Score

10^/10

njrat discovery persistence trojan

Malware Config

Targets

- Target
  
  56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe
- Size
  
  164KB
- MD5
  
  1ebb888eb774b33e4f91d7dad2c00737
- SHA1
  
  f272c1a38563aa52d40dad5234ec3a5284768e26
- SHA256
  
  56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f
- SHA512
  
  beb867449918c2ace20abf0b92654c6eee5bca74dc4af8053cb31f838775e96350e40c4a6ea7067d24c4f53b5b767d6e343623ef8faa37847165c82a00cff1c6
- SSDEEP
  
  3072:8w11/wTvYZDDNF90qhRb70L8czxE2YY6q9bLzl6fHMEBuo3:8wZD9b70wczSTYh9bAlD3
Score

10^/10

njrat discovery persistence trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoverypersistencetrojan

behavioral2

discoverypersistence