njrat | be1b9c5e4be21a8c2e66564bac3fbceaf436625cf525db52d272205d20e997db | Triage

Sharing

General

Target

JaffaCakes118_6977ced4b7ce1b0f0aa3a46e48e81130
Size

23KB
Sample

250103-b6ds1sxmbj
MD5

6977ced4b7ce1b0f0aa3a46e48e81130
SHA1

c1a0fdcf8cd940881305d2f7f881211df1bf0084
SHA256

be1b9c5e4be21a8c2e66564bac3fbceaf436625cf525db52d272205d20e997db
SHA512

f4210252655ffda38332250dcf72f5a93dfb242f7b7d9f88a898510c109e868a1def4c979e5588e206cada62d2aa1a0ffcf22c8c6bfbda6689c18305df4a1e0f
SSDEEP

384:kcqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZS8:z30py6vhxaRpcnu0

Score

10^/10

njrat ddssd discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

ddssd

C2

new8rood.no-ip.biz:1414

Mutex

b6d8ee9649691521ddab48e69a3791c3

Attributes

reg_key
b6d8ee9649691521ddab48e69a3791c3
splitter
|'|'|

Targets

- Target
  
  JaffaCakes118_6977ced4b7ce1b0f0aa3a46e48e81130
- Size
  
  23KB
- MD5
  
  6977ced4b7ce1b0f0aa3a46e48e81130
- SHA1
  
  c1a0fdcf8cd940881305d2f7f881211df1bf0084
- SHA256
  
  be1b9c5e4be21a8c2e66564bac3fbceaf436625cf525db52d272205d20e997db
- SHA512
  
  f4210252655ffda38332250dcf72f5a93dfb242f7b7d9f88a898510c109e868a1def4c979e5588e206cada62d2aa1a0ffcf22c8c6bfbda6689c18305df4a1e0f
- SSDEEP
  
  384:kcqbCK0l4h7o9SVyDGvENuh46/gJkOmMSW38mRvR6JZlbw8hqIusZzZS8:z30py6vhxaRpcnu0
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan