njrat | 1801c2f622cdd9ea25422d5a78dcab5a4a6b2e56eea7843babbdd3e1754176ab | Triage

Sharing

General

Target

JaffaCakes118_9d71002984122f04a321cf37fc609ba3
Size

275KB
Sample

250108-nsbgys1jdj
MD5

9d71002984122f04a321cf37fc609ba3
SHA1

73fe89e97c67aa83fda7fd0a196541f1b536fbad
SHA256

1801c2f622cdd9ea25422d5a78dcab5a4a6b2e56eea7843babbdd3e1754176ab
SHA512

f5fb21f5092efe1ecc03aac1641d5006abddce710097ef7566b8e2608cd4031d9521ecaec0a9c7ff0404d04818b4dc1483fddebac152944ad9bc5918a0cc7b7a
SSDEEP

3072:FghID3ikQ3zhVaAaPxBwOPgJGpFqriFzdFhKHjxQOA8Lvx7lS1BY+yTZoJJHv8:sFl9JGKiJEDWd8LxUMbZoJJP

Score

10^/10

njrat sveikas atvykes i stebuklu saly:)evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Sveikas Atvykes I stebuklu Saly:)

C2

droidnuuuu.chickenkiller.com:4567

Mutex

0cf1c1ec350102a29be22c9c82437818

Attributes

reg_key
0cf1c1ec350102a29be22c9c82437818
splitter
|'|'|

Targets

- Target
  
  JaffaCakes118_9d71002984122f04a321cf37fc609ba3
- Size
  
  275KB
- MD5
  
  9d71002984122f04a321cf37fc609ba3
- SHA1
  
  73fe89e97c67aa83fda7fd0a196541f1b536fbad
- SHA256
  
  1801c2f622cdd9ea25422d5a78dcab5a4a6b2e56eea7843babbdd3e1754176ab
- SHA512
  
  f5fb21f5092efe1ecc03aac1641d5006abddce710097ef7566b8e2608cd4031d9521ecaec0a9c7ff0404d04818b4dc1483fddebac152944ad9bc5918a0cc7b7a
- SSDEEP
  
  3072:FghID3ikQ3zhVaAaPxBwOPgJGpFqriFzdFhKHjxQOA8Lvx7lS1BY+yTZoJJHv8:sFl9JGKiJEDWd8LxUMbZoJJP
Score

10^/10

njrat sveikas atvykes i stebuklu saly:)evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratsveikas atvykes i stebuklu saly:)evasionpersistenceprivilege_escalationtrojan

behavioral2

njratsveikas atvykes i stebuklu saly:)evasionpersistenceprivilege_escalationtrojan