njrat | 19ba2b0bdbb7794da2f84ce4b601163d0ddaa61bb3b6e20b9210d859e4a83ad8 | Triage

Sharing

General

Target

JaffaCakes118_540286ff47adaebefe6a2e0f2b9eb710
Size

400KB
Sample

250101-n1qxlswpdk
MD5

540286ff47adaebefe6a2e0f2b9eb710
SHA1

4d8c8a563084b2b78a191ec5038f13c38f8589d5
SHA256

19ba2b0bdbb7794da2f84ce4b601163d0ddaa61bb3b6e20b9210d859e4a83ad8
SHA512

ef3d2a1f42c21f6d0902e544399c6bab8974482ce207617b3e122dc4227445972c6da0a0816b2a78f348c357e1bf37177dfa105fc6285ffce9d250281ea2c600
SSDEEP

3072:lLkX4uRAiZ+odTV2UELRqnSFLW7RE+n/5t+mbbwkqZWQIpjFaI5SFQ9cRWFgvU/h:lwOkHbr1GU/gJ

Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_540286ff47adaebefe6a2e0f2b9eb710
- Size
  
  400KB
- MD5
  
  540286ff47adaebefe6a2e0f2b9eb710
- SHA1
  
  4d8c8a563084b2b78a191ec5038f13c38f8589d5
- SHA256
  
  19ba2b0bdbb7794da2f84ce4b601163d0ddaa61bb3b6e20b9210d859e4a83ad8
- SHA512
  
  ef3d2a1f42c21f6d0902e544399c6bab8974482ce207617b3e122dc4227445972c6da0a0816b2a78f348c357e1bf37177dfa105fc6285ffce9d250281ea2c600
- SSDEEP
  
  3072:lLkX4uRAiZ+odTV2UELRqnSFLW7RE+n/5t+mbbwkqZWQIpjFaI5SFQ9cRWFgvU/h:lwOkHbr1GU/gJ
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan