njrat | 75821bd23bd87bb60913be5c4995b046abd08044cd07d3c4727dd0c297d2708a | Triage

Sharing

General

Target

JaffaCakes118_178048e50c27c7b07b07267852da6766
Size

69KB
Sample

241231-nd531sxqax
MD5

178048e50c27c7b07b07267852da6766
SHA1

539fa175f2f67fff86ebe5563b63a3980d7604e0
SHA256

75821bd23bd87bb60913be5c4995b046abd08044cd07d3c4727dd0c297d2708a
SHA512

c2ec0bc439741c617113b164650129c75a81f09963ecabd4d457e8232e2c559595fc9b2bf2a83bee6510e1dd28b4d874a4dfcc98649ef2eab308670f8afc9bbf
SSDEEP

1536:W2I+k/D0y3eJG53G73mxdvd0x1muYO5OuSr9/fO5CWey:W2I+k/D0y32GhNvOauTwlAIVy

Score

10^/10

njrat west-k.s.a @discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

WeSt-K.S.A @

C2

127.0.0.1:5551

Mutex

0f436963af986f0915e6f175d79d7302

Attributes

reg_key
0f436963af986f0915e6f175d79d7302
splitter
|'|'|

Targets

- Target
  
  JaffaCakes118_178048e50c27c7b07b07267852da6766
- Size
  
  69KB
- MD5
  
  178048e50c27c7b07b07267852da6766
- SHA1
  
  539fa175f2f67fff86ebe5563b63a3980d7604e0
- SHA256
  
  75821bd23bd87bb60913be5c4995b046abd08044cd07d3c4727dd0c297d2708a
- SHA512
  
  c2ec0bc439741c617113b164650129c75a81f09963ecabd4d457e8232e2c559595fc9b2bf2a83bee6510e1dd28b4d874a4dfcc98649ef2eab308670f8afc9bbf
- SSDEEP
  
  1536:W2I+k/D0y3eJG53G73mxdvd0x1muYO5OuSr9/fO5CWey:W2I+k/D0y32GhNvOauTwlAIVy
Score

10^/10

njrat west-k.s.a @discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratwest-k.s.a @discoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratwest-k.s.a @discoveryevasionpersistenceprivilege_escalationtrojan