njrat | 6dc6d0488aafd93e6429b763b804d23e873c56369db5ebff2c39a77c93f2bb38 | Triage

Sharing

General

Target

JaffaCakes118_a1abac9488a0fc642d21b64df10ecb93
Size

32KB
Sample

250105-nv8v8stjbw
MD5

a1abac9488a0fc642d21b64df10ecb93
SHA1

e769042b81b21f397e45146c692ba4ff6f8bdb02
SHA256

6dc6d0488aafd93e6429b763b804d23e873c56369db5ebff2c39a77c93f2bb38
SHA512

2bbe90116d8a60ea6905918c09a7589d2c2034cf24d94aec0342554f2554b469ed634e75f952d5b82dcdfa943355c3f6d5fec206882bf2f0fa32783a53973871
SSDEEP

768:lantajTJN8bYeeTJ3f8le8+6bgZUfWq/o6gtnlsX1:lGmTJN8vWNUle8+QgZPnlsl

Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  JaffaCakes118_a1abac9488a0fc642d21b64df10ecb93
- Size
  
  32KB
- MD5
  
  a1abac9488a0fc642d21b64df10ecb93
- SHA1
  
  e769042b81b21f397e45146c692ba4ff6f8bdb02
- SHA256
  
  6dc6d0488aafd93e6429b763b804d23e873c56369db5ebff2c39a77c93f2bb38
- SHA512
  
  2bbe90116d8a60ea6905918c09a7589d2c2034cf24d94aec0342554f2554b469ed634e75f952d5b82dcdfa943355c3f6d5fec206882bf2f0fa32783a53973871
- SSDEEP
  
  768:lantajTJN8bYeeTJ3f8le8+6bgZUfWq/o6gtnlsX1:lGmTJN8vWNUle8+QgZPnlsl
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan