njrat | ebfb0317d4d1df0b27edf617ba139a70c2de4af41734facf12c6aa739149256f | Triage

Sharing

General

Target

JaffaCakes118_6e0cf92bc5a433170cb65467ffc4c7a0
Size

81KB
Sample

250103-vctf6atlfw
MD5

6e0cf92bc5a433170cb65467ffc4c7a0
SHA1

498e84529f4869e0efc0d94def30f68be69d4ce0
SHA256

ebfb0317d4d1df0b27edf617ba139a70c2de4af41734facf12c6aa739149256f
SHA512

17a25c9eecc888a8941b30282445f34c284e7d57031e7176a3584b54c34180b1459f9438d5a73147360bac923af3fcc4c6dc3cb4d45aa64b70d78a7f0506fe65
SSDEEP

384:BluBPiZCMfdfSJrQbsLRGSIxYVL46pg/i8BD9FmRvR6JZlbw8hqIusZzZQyo:WOmhtI+RpcnuvL

Score

10^/10

njrat e x t r a discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

E X T R A

C2

174.127.99.175:1166

Mutex

4215198d9ee8caffb51b32ec2ae3b0ae

Attributes

reg_key
4215198d9ee8caffb51b32ec2ae3b0ae
splitter
|'|'|

Targets

- Target
  
  JaffaCakes118_6e0cf92bc5a433170cb65467ffc4c7a0
- Size
  
  81KB
- MD5
  
  6e0cf92bc5a433170cb65467ffc4c7a0
- SHA1
  
  498e84529f4869e0efc0d94def30f68be69d4ce0
- SHA256
  
  ebfb0317d4d1df0b27edf617ba139a70c2de4af41734facf12c6aa739149256f
- SHA512
  
  17a25c9eecc888a8941b30282445f34c284e7d57031e7176a3584b54c34180b1459f9438d5a73147360bac923af3fcc4c6dc3cb4d45aa64b70d78a7f0506fe65
- SSDEEP
  
  384:BluBPiZCMfdfSJrQbsLRGSIxYVL46pg/i8BD9FmRvR6JZlbw8hqIusZzZQyo:WOmhtI+RpcnuvL
Score

10^/10

njrat e x t r a discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

e x t r a njrat

behavioral1

njrate x t r a discoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan