njrat | 28048f8ea3ec1de82fc06ab3905d98db7928db06bc0faac0cbd528de5a43de68 | Triage

Sharing

General

Target

JaffaCakes118_6d9aec6d5019e3627d059d1af2ca2e50
Size

29KB
Sample

250103-ss8jxatmbp
MD5

6d9aec6d5019e3627d059d1af2ca2e50
SHA1

74ebbc8a8d39cdb4c60e876826761ec92b72648c
SHA256

28048f8ea3ec1de82fc06ab3905d98db7928db06bc0faac0cbd528de5a43de68
SHA512

594cfd2e2a3c5876a74e2e1254fbff11ac198100124138d839407b064c780c00fc6c0d94e0d27db44aa100cafc9290370afe4dc5e074a6e9ae3cbd52a6cff1b5
SSDEEP

384:7tYs5l7VL9skVQ42BkSv5dAsCGmqDm+jeI7GBsbh0w4wlAokw9OhgOL1vYRGOZzZ:7V7/skCXkQossqtje3BKh0p29SgRuK

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

ayman1.no-ip.biz:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Targets

- Target
  
  JaffaCakes118_6d9aec6d5019e3627d059d1af2ca2e50
- Size
  
  29KB
- MD5
  
  6d9aec6d5019e3627d059d1af2ca2e50
- SHA1
  
  74ebbc8a8d39cdb4c60e876826761ec92b72648c
- SHA256
  
  28048f8ea3ec1de82fc06ab3905d98db7928db06bc0faac0cbd528de5a43de68
- SHA512
  
  594cfd2e2a3c5876a74e2e1254fbff11ac198100124138d839407b064c780c00fc6c0d94e0d27db44aa100cafc9290370afe4dc5e074a6e9ae3cbd52a6cff1b5
- SSDEEP
  
  384:7tYs5l7VL9skVQ42BkSv5dAsCGmqDm+jeI7GBsbh0w4wlAokw9OhgOL1vYRGOZzZ:7V7/skCXkQossqtje3BKh0p29SgRuK
Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

discoveryevasionpersistenceprivilege_escalation