njrat | 5a37df41c699de4db40cce4ccb3bd9388a1cfb9691b803572effd6bf01a42514 | Triage

Sharing

General

Target

JaffaCakes118_ba992f195c2a1517afe0bddd513459e5
Size

33KB
Sample

250105-ymn6zatrcx
MD5

ba992f195c2a1517afe0bddd513459e5
SHA1

d148b93b652cf051263d030c66ec3bd0e8926267
SHA256

5a37df41c699de4db40cce4ccb3bd9388a1cfb9691b803572effd6bf01a42514
SHA512

9131ab7296b5f75be286cb52fcb9fa429b5637bb0332fb9fbd7e838b74277b8a9af8f8d6db6c3f161efa82f7d6df75397a46e7e00a2028ab5f5766f542218c28
SSDEEP

768:PnKR7bUw2C/o26qupedBKh0p29SgRK15:vY7b2f/+KhG29jK15

Score

10^/10

njrat west-k.s.a @evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

WeSt-K.S.A @

C2

127.0.0.1:5551

Mutex

0f436963af986f0915e6f175d79d7302

Attributes

reg_key
0f436963af986f0915e6f175d79d7302
splitter
|'|'|

Targets

- Target
  
  JaffaCakes118_ba992f195c2a1517afe0bddd513459e5
- Size
  
  33KB
- MD5
  
  ba992f195c2a1517afe0bddd513459e5
- SHA1
  
  d148b93b652cf051263d030c66ec3bd0e8926267
- SHA256
  
  5a37df41c699de4db40cce4ccb3bd9388a1cfb9691b803572effd6bf01a42514
- SHA512
  
  9131ab7296b5f75be286cb52fcb9fa429b5637bb0332fb9fbd7e838b74277b8a9af8f8d6db6c3f161efa82f7d6df75397a46e7e00a2028ab5f5766f542218c28
- SSDEEP
  
  768:PnKR7bUw2C/o26qupedBKh0p29SgRK15:vY7b2f/+KhG29jK15
Score

10^/10

njrat west-k.s.a @evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratwest-k.s.a @evasionpersistenceprivilege_escalationtrojan

behavioral2

njratwest-k.s.a @evasionpersistenceprivilege_escalationtrojan