njrat | b52e16b631bdd93334a7fc621c9efb6b17bd3bb41e02b4728f3b187b27da53df | Triage

Sharing

General

Target

LaucherSynapseV4.7z
Size

14KB
Sample

241222-nygwxswrfs
MD5

6a51bf0c7ed3fd5c2986d2ca98bdf995
SHA1

b8aa073566657c05dba53b0d61554b99cf6cb6a1
SHA256

b52e16b631bdd93334a7fc621c9efb6b17bd3bb41e02b4728f3b187b27da53df
SHA512

af48f8a73241d33ac51e3f0317e13b594b82f55444e9f04831b733ff7aa011a06b1e94a14b7c56e1cc754e1c3901111719f957f4d56f208436717c7d7a97433b
SSDEEP

384:5nQz4K8t9rZJnPn56Oq2tmIrTTHGcMmR4G2vErfQ2hi:l79t9rZJnPnoOqkmIrTTHGcM4fhi

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

7.tcp.eu.ngrok.io:9999

Mutex

1424bc7ca87eb46d8533045fc4efb564

Attributes

reg_key
1424bc7ca87eb46d8533045fc4efb564
splitter
|'|'|

Targets

- Target
  
  LaucherSynapseV4.7z
- Size
  
  14KB
- MD5
  
  6a51bf0c7ed3fd5c2986d2ca98bdf995
- SHA1
  
  b8aa073566657c05dba53b0d61554b99cf6cb6a1
- SHA256
  
  b52e16b631bdd93334a7fc621c9efb6b17bd3bb41e02b4728f3b187b27da53df
- SHA512
  
  af48f8a73241d33ac51e3f0317e13b594b82f55444e9f04831b733ff7aa011a06b1e94a14b7c56e1cc754e1c3901111719f957f4d56f208436717c7d7a97433b
- SSDEEP
  
  384:5nQz4K8t9rZJnPn56Oq2tmIrTTHGcMmR4G2vErfQ2hi:l79t9rZJnPnoOqkmIrTTHGcM4fhi
Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Legitimate hosting services abused for malware hosting/C2
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan