njrat | f77ca04e76cd8ba8993380854f00ec0c577acec3e9af43ef84359e117b95a9b5 | Triage

Sharing

General

Target

JaffaCakes118_68355cc0f110c2bc9ec7e0a10fcf6e00
Size

23KB
Sample

250102-zrt4fsylbn
MD5

68355cc0f110c2bc9ec7e0a10fcf6e00
SHA1

79cd92523fb48060b1a26285fa1f1b0627c43036
SHA256

f77ca04e76cd8ba8993380854f00ec0c577acec3e9af43ef84359e117b95a9b5
SHA512

651ec0861f3b56594cacace7591393fcd676a96bbde36617cd445bf22b802ae941aa1e1c13819a9435d5f6f8c028e3d531ac1064ddcef1b71f686ead47b5c1ba
SSDEEP

384:5TTSLV/+D2sic6qfw38JeiWawJ3fw6FgzeAhEcRtmRvR6JZlbw8hqIusZzZMy:Q9GJic6qd1WEIRpcnuo

Score

10^/10

njrat تم الدعس من قبل يامن discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

تم الدعس من قبل يامن

C2

ahmidada.no-ip.org:5552

Mutex

cfdac762c6c589fe5622c99ffb681483

Attributes

reg_key
cfdac762c6c589fe5622c99ffb681483
splitter
|'|'|

Targets

- Target
  
  JaffaCakes118_68355cc0f110c2bc9ec7e0a10fcf6e00
- Size
  
  23KB
- MD5
  
  68355cc0f110c2bc9ec7e0a10fcf6e00
- SHA1
  
  79cd92523fb48060b1a26285fa1f1b0627c43036
- SHA256
  
  f77ca04e76cd8ba8993380854f00ec0c577acec3e9af43ef84359e117b95a9b5
- SHA512
  
  651ec0861f3b56594cacace7591393fcd676a96bbde36617cd445bf22b802ae941aa1e1c13819a9435d5f6f8c028e3d531ac1064ddcef1b71f686ead47b5c1ba
- SSDEEP
  
  384:5TTSLV/+D2sic6qfw38JeiWawJ3fw6FgzeAhEcRtmRvR6JZlbw8hqIusZzZMy:Q9GJic6qd1WEIRpcnuo
Score

10^/10

njrat تم الدعس من قبل يامن discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

تم الدعس من قبل يامنnjrat

behavioral1

njratتم الدعس من قبل يامنdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan