njrat | e839a805feb80d2c56bed12d39f330b97f4f59439de9d71f3d38e0705e81ea2f | Triage

Sharing

General

Target

JaffaCakes118_62b10a3175818431001507c305a49490
Size

65KB
Sample

250102-e7xjastlgt
MD5

62b10a3175818431001507c305a49490
SHA1

c0e6189a44e96abd512aec72f0757143101b9e02
SHA256

e839a805feb80d2c56bed12d39f330b97f4f59439de9d71f3d38e0705e81ea2f
SHA512

198f404980199f9378eef40be54181c26f2bad3b19c8de8b73acbc1cafe1fae3bc45b18f65ff992e073365d9c7eb2051d1d4b92d826a57057e5902ba17b262e2
SSDEEP

1536:3r0GczfafmPxS9Cdt9t7+n/GtJ03BB++qhsY:3gGcOKhBt7+n/G43Y5

Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

ahmedwind.no-ip.org:1177

Mutex

026a497eb8f5870d3236fd34198c3d35

Attributes

reg_key
026a497eb8f5870d3236fd34198c3d35
splitter
|'|'|

Targets

- Target
  
  JaffaCakes118_62b10a3175818431001507c305a49490
- Size
  
  65KB
- MD5
  
  62b10a3175818431001507c305a49490
- SHA1
  
  c0e6189a44e96abd512aec72f0757143101b9e02
- SHA256
  
  e839a805feb80d2c56bed12d39f330b97f4f59439de9d71f3d38e0705e81ea2f
- SHA512
  
  198f404980199f9378eef40be54181c26f2bad3b19c8de8b73acbc1cafe1fae3bc45b18f65ff992e073365d9c7eb2051d1d4b92d826a57057e5902ba17b262e2
- SSDEEP
  
  1536:3r0GczfafmPxS9Cdt9t7+n/GtJ03BB++qhsY:3gGcOKhBt7+n/G43Y5
Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackedevasionpersistenceprivilege_escalationtrojan

behavioral2

njrathackedevasionpersistenceprivilege_escalationtrojan