njrat | 0a0982e2e395debb82f0e834a9a5a8a5bb9c3e28ed8d689b07f4ea4f6d6fbe1f | Triage

Sharing

General

Target

JaffaCakes118_a7f56e74acb142c70bdedbf6ca88a2ab
Size

65KB
Sample

250108-x7zb1azndv
MD5

a7f56e74acb142c70bdedbf6ca88a2ab
SHA1

f3b0f066184417e98e4c9ecd3523a3ee1354b36a
SHA256

0a0982e2e395debb82f0e834a9a5a8a5bb9c3e28ed8d689b07f4ea4f6d6fbe1f
SHA512

bf3f1f445619edb2a1476a46e8874a716e9fd2e46da1818d83084cc1944554655860a384a3f303915d100f3dddc92af0df40de4c06b576c4c9f1d14cfbf3a511
SSDEEP

1536:tYgyythn0smQmXFhaNcSFDx6DBY6dOATmLR1vxl8:SgyyznbmQAhe/Fx2HBTmLDvxl8

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

66.102.1.188:5555

Mutex

da469bc20951884431b00ec6439394f2

Attributes

reg_key
da469bc20951884431b00ec6439394f2
splitter
|'|'|

Targets

- Target
  
  JaffaCakes118_a7f56e74acb142c70bdedbf6ca88a2ab
- Size
  
  65KB
- MD5
  
  a7f56e74acb142c70bdedbf6ca88a2ab
- SHA1
  
  f3b0f066184417e98e4c9ecd3523a3ee1354b36a
- SHA256
  
  0a0982e2e395debb82f0e834a9a5a8a5bb9c3e28ed8d689b07f4ea4f6d6fbe1f
- SHA512
  
  bf3f1f445619edb2a1476a46e8874a716e9fd2e46da1818d83084cc1944554655860a384a3f303915d100f3dddc92af0df40de4c06b576c4c9f1d14cfbf3a511
- SSDEEP
  
  1536:tYgyythn0smQmXFhaNcSFDx6DBY6dOATmLR1vxl8:SgyyznbmQAhe/Fx2HBTmLDvxl8
Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackeddiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan