njrat | 707c81984e055b8ef5bf439bec0449be52ea160180baf60df314abab53133937 | Triage

Sharing

General

Target

JaffaCakes118_6b4961bd714e87ac58bc94057c4729a0
Size

128KB
Sample

250103-j1421svqay
MD5

6b4961bd714e87ac58bc94057c4729a0
SHA1

0f90067112fe4d6de159bb4170fafc4abf111907
SHA256

707c81984e055b8ef5bf439bec0449be52ea160180baf60df314abab53133937
SHA512

45887544f16f59dc6063ed96a7f3e04335120d08b0f7e6f20412e4fa6cbb6bd90b1a230af07508e6195bb381c1c2b92624a14a33b4d9bc4b075fe9cecebb9679
SSDEEP

3072:JIJO91gvrt/YObLz6tTs6b/KItLvYFdJIwFAd/LWxidvIuV:H1OtgWLGtfb/1lviIkAdEid5

Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

backdoor25.no-ip.org:81

Mutex

23556fb1360f366337f97c924e76ead3

Attributes

reg_key
23556fb1360f366337f97c924e76ead3
splitter
|'|'|

Targets

- Target
  
  JaffaCakes118_6b4961bd714e87ac58bc94057c4729a0
- Size
  
  128KB
- MD5
  
  6b4961bd714e87ac58bc94057c4729a0
- SHA1
  
  0f90067112fe4d6de159bb4170fafc4abf111907
- SHA256
  
  707c81984e055b8ef5bf439bec0449be52ea160180baf60df314abab53133937
- SHA512
  
  45887544f16f59dc6063ed96a7f3e04335120d08b0f7e6f20412e4fa6cbb6bd90b1a230af07508e6195bb381c1c2b92624a14a33b4d9bc4b075fe9cecebb9679
- SSDEEP
  
  3072:JIJO91gvrt/YObLz6tTs6b/KItLvYFdJIwFAd/LWxidvIuV:H1OtgWLGtfb/1lviIkAdEid5
Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackedevasionpersistenceprivilege_escalationtrojan

behavioral2

njrathackedevasionpersistenceprivilege_escalationtrojan