njrat | 23177f2f6b1e1b33c7b10f6602051994fa952a21a4cbb170004f04357f50e41e | Triage

Sharing

General

Target

JaffaCakes118_7c1d6e22ea6de18bbbc8d944ae1390f0
Size

95KB
Sample

250104-11krta1raq
MD5

7c1d6e22ea6de18bbbc8d944ae1390f0
SHA1

bfca28789f7f59b3fb58da2febfdd1dc765240c8
SHA256

23177f2f6b1e1b33c7b10f6602051994fa952a21a4cbb170004f04357f50e41e
SHA512

c48f9b05359886972a19e5bfc3e3b94186578c2bb285175faacaee6b2c92eb3cc91accac36beda97ac67cf9937e32a04024ddb04bf7024b3e83b377ea4384384
SSDEEP

1536:8i6t4sgQwmRdNRhfKCvkB08Gc/WNHrCwhwa9cK9GZExq5i2o4UH3DFbMuc:8iK4sFwQdNDfKmxr/H9z9Y5o4UTFou

Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

superstart.myq-see.com:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Targets

- Target
  
  JaffaCakes118_7c1d6e22ea6de18bbbc8d944ae1390f0
- Size
  
  95KB
- MD5
  
  7c1d6e22ea6de18bbbc8d944ae1390f0
- SHA1
  
  bfca28789f7f59b3fb58da2febfdd1dc765240c8
- SHA256
  
  23177f2f6b1e1b33c7b10f6602051994fa952a21a4cbb170004f04357f50e41e
- SHA512
  
  c48f9b05359886972a19e5bfc3e3b94186578c2bb285175faacaee6b2c92eb3cc91accac36beda97ac67cf9937e32a04024ddb04bf7024b3e83b377ea4384384
- SSDEEP
  
  1536:8i6t4sgQwmRdNRhfKCvkB08Gc/WNHrCwhwa9cK9GZExq5i2o4UH3DFbMuc:8iK4sFwQdNDfKmxr/H9z9Y5o4UTFou
Score

10^/10

njrat hacked evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackedevasionpersistenceprivilege_escalationtrojan

behavioral2

njrathackedevasionpersistenceprivilege_escalationtrojan