njrat | 0346b279163aa2d1026a529c89c7a607e0903fe3da8e0662ab10e8fb6ec47f7f | Triage

Sharing

General

Target

0346b279163aa2d1026a529c89c7a607e0903fe3da8e0662ab10e8fb6ec47f7fN.exe
Size

76KB
Sample

241219-3gpmrstlgj
MD5

28932057148d602175b69d53d0a27090
SHA1

ca78c2773f4716116e063b52b4dec9a2bfedb94a
SHA256

0346b279163aa2d1026a529c89c7a607e0903fe3da8e0662ab10e8fb6ec47f7f
SHA512

2dc348bddd1233bbd9ca87943e9a4a8eee92d8dc89bc91610b19a55d5d117daba11ca532f6d011a6094b34806ccba3769a37b56b556b657f8d419181b47c910a
SSDEEP

1536:v6MLReVUavGJGjm/tCUX+CUNl1UXv4wuiXEEXsMPTuwPSoP2o/Omoljw5C9tgoi3:C+Re9+kjm/tC4+CUNl1UXv4wuiXEEduW

Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

drnet.zapto.org:5552

Mutex

6c2bc48bba8dc02e1542041ac026a380

Attributes

reg_key
6c2bc48bba8dc02e1542041ac026a380
splitter
|'|'|

Targets

- Target
  
  0346b279163aa2d1026a529c89c7a607e0903fe3da8e0662ab10e8fb6ec47f7fN.exe
- Size
  
  76KB
- MD5
  
  28932057148d602175b69d53d0a27090
- SHA1
  
  ca78c2773f4716116e063b52b4dec9a2bfedb94a
- SHA256
  
  0346b279163aa2d1026a529c89c7a607e0903fe3da8e0662ab10e8fb6ec47f7f
- SHA512
  
  2dc348bddd1233bbd9ca87943e9a4a8eee92d8dc89bc91610b19a55d5d117daba11ca532f6d011a6094b34806ccba3769a37b56b556b657f8d419181b47c910a
- SSDEEP
  
  1536:v6MLReVUavGJGjm/tCUX+CUNl1UXv4wuiXEEXsMPTuwPSoP2o/Omoljw5C9tgoi3:C+Re9+kjm/tC4+CUNl1UXv4wuiXEEduW
Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackedevasionpersistenceprivilege_escalationtrojan

behavioral2

njrathackedevasionpersistenceprivilege_escalationtrojan