njrat | ce8df335e02fcb5ad4e5316871b37e8f123fb4f24a41b1c6aedf59cb4df8d474 | Triage™

Login
Reports

Overview

overview

Static

static

20401cee61...01.exe

windows7-x64

20401cee61...01.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
20401cee61e807093108d04d70376c01.exe
Size 23KB
Sample250108-t9ylpsylfp
SHA256 ce8df335e02fcb5ad4e5316871b37e8f123fb4f24a41b1c6aedf59cb4df8d474
MD5 20401cee61e807093108d04d70376c01
SHA1 137ca1a97b1569416a719372198e9e157cb2ed67
SHA512 c21f9168883ff94981b66c57f3ecffe277adb8bd8a95f23266f628da78b465776c06ea7dc1f970103bd2bbf290444ac22b1c0811ded2e5b1b921113827f7ba6c
SSDEEP 384:7sqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZ0u5:Qf65K2Yf1jKRpcnuDK
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

20401cee61e807093108d04d70376c01.exe

Resource

win7-20240903-en

windows7-x64

8 signatures

150 seconds

njrat discovery evasion persistence privilege_escalation trojan

Behavioral task

behavioral2

Sample

20401cee61e807093108d04d70376c01.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

8 signatures

150 seconds

njrat discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

103.82.249.78:3158

Mutex

40fe9ace8bb9fb475ea9e0177c8de3aa

Attributes

reg_key
40fe9ace8bb9fb475ea9e0177c8de3aa
splitter
|'|'|

Targets

- Target
  20401cee61e807093108d04d70376c01.exe
- Size 23KB
- SHA256 ce8df335e02fcb5ad4e5316871b37e8f123fb4f24a41b1c6aedf59cb4df8d474
- MD5 20401cee61e807093108d04d70376c01
- SHA1 137ca1a97b1569416a719372198e9e157cb2ed67
- SHA512 c21f9168883ff94981b66c57f3ecffe277adb8bd8a95f23266f628da78b465776c06ea7dc1f970103bd2bbf290444ac22b1c0811ded2e5b1b921113827f7ba6c
- SSDEEP 384:7sqS+ER6vRKXGYKRWVSujUtX9w6Dglo61Z5DVmRvR6JZlbw8hqIusZzZ0u5:Qf65K2Yf1jKRpcnuDK
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

© 2018-2026

Terms | Privacy