njrat | b6ddc32edd7c9b2eef7d4f5759e71b5b07e46c356d37801af56f863b29a57123 | Triage

Sharing

General

Target

JaffaCakes118_609d415be01bab68d1cb99958a56f150
Size

111KB
Sample

250101-zqz83stney
MD5

609d415be01bab68d1cb99958a56f150
SHA1

e687190cdcb717078f7599faeb97aff194f62b1c
SHA256

b6ddc32edd7c9b2eef7d4f5759e71b5b07e46c356d37801af56f863b29a57123
SHA512

f1f1dc523cab93c5760653edd2a0b7dfe92623eed45fe5c7409f77e8a79e8a162fd90ca263466278a39dc21e9f3127c20d39e93df9bdeb9c06b4182f3bebd0fc
SSDEEP

3072:E5S+/yyhkZFcqvs4TzkQNFxph8G4q6IElWD:E5S8yjZFx04kQN5h8GRi

Score

10^/10

njrat fixed 6 evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

fixed 6

C2

adeek.no-ip.org:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Targets

- Target
  
  JaffaCakes118_609d415be01bab68d1cb99958a56f150
- Size
  
  111KB
- MD5
  
  609d415be01bab68d1cb99958a56f150
- SHA1
  
  e687190cdcb717078f7599faeb97aff194f62b1c
- SHA256
  
  b6ddc32edd7c9b2eef7d4f5759e71b5b07e46c356d37801af56f863b29a57123
- SHA512
  
  f1f1dc523cab93c5760653edd2a0b7dfe92623eed45fe5c7409f77e8a79e8a162fd90ca263466278a39dc21e9f3127c20d39e93df9bdeb9c06b4182f3bebd0fc
- SSDEEP
  
  3072:E5S+/yyhkZFcqvs4TzkQNFxph8G4q6IElWD:E5S8yjZFx04kQN5h8GRi
Score

10^/10

njrat fixed 6 evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratfixed 6evasionpersistenceprivilege_escalationtrojan

behavioral2

njratfixed 6evasionpersistenceprivilege_escalationtrojan