njrat | 131a42c29d3359bbace76b83d8cb864993ca0a849087b8dff8c2511eeaec36e3 | Triage

Sharing

General

Target

JaffaCakes118_9fe1d93f5411af1aab1b404b01039e06
Size

93KB
Sample

250105-m8skqssmcw
MD5

9fe1d93f5411af1aab1b404b01039e06
SHA1

ab17d917313dedc8a7e7b92dc658ca938ff25c98
SHA256

131a42c29d3359bbace76b83d8cb864993ca0a849087b8dff8c2511eeaec36e3
SHA512

68ab24f84f6faaa3de1c3f5b1f67fbe8031f40b4a7ed3c4920010f410fbdec7dad49f5a647f50411c8e8d3504df80382ca2e37bdc668886c1cd81b293405d50d
SSDEEP

768:IY3YxBnkpjTMpALPGMtsas88EtNXhe9Y1mxCXxrjEtCdnl2pi1Rz4Rk3RsGdpUgM:oxRkVbPGHz88EbB1pjEwzGi1dDBDUgS

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:5552

Mutex

1e3dede283d0a0233557b149319e9d4c

Attributes

reg_key
1e3dede283d0a0233557b149319e9d4c
splitter
|'|'|

Targets

- Target
  
  JaffaCakes118_9fe1d93f5411af1aab1b404b01039e06
- Size
  
  93KB
- MD5
  
  9fe1d93f5411af1aab1b404b01039e06
- SHA1
  
  ab17d917313dedc8a7e7b92dc658ca938ff25c98
- SHA256
  
  131a42c29d3359bbace76b83d8cb864993ca0a849087b8dff8c2511eeaec36e3
- SHA512
  
  68ab24f84f6faaa3de1c3f5b1f67fbe8031f40b4a7ed3c4920010f410fbdec7dad49f5a647f50411c8e8d3504df80382ca2e37bdc668886c1cd81b293405d50d
- SSDEEP
  
  768:IY3YxBnkpjTMpALPGMtsas88EtNXhe9Y1mxCXxrjEtCdnl2pi1Rz4Rk3RsGdpUgM:oxRkVbPGHz88EbB1pjEwzGi1dDBDUgS
Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

discoveryevasionpersistenceprivilege_escalation