njrat | 606938c343ff1eb7278561785855589f46b06dfbc6925b1bb2173d3722c9f393 | Triage

Sharing

General

Target

JaffaCakes118_c82090cb1238272ea71d0e1c46c925f7
Size

81KB
Sample

250109-pmrsessjam
MD5

c82090cb1238272ea71d0e1c46c925f7
SHA1

ad35aff2b8541fd295c3acb2adb24d3551140750
SHA256

606938c343ff1eb7278561785855589f46b06dfbc6925b1bb2173d3722c9f393
SHA512

247ff4e5f59ab366c8bcc0135c66c53a4e6336bd653705296e20ef37342dde0f3511190e53e27e026911dfb9d95fe15e602121c763fbf37eefcc092fc78cb178
SSDEEP

1536:MGIFfmuPLEm3fo8w2oEramguwePcBMU+X6mmH7PNZwmwsOI7m3dUpbmh5O:jmQ8ww++/PcBMU+X6mu7PNZ6TtUAO

Score

10^/10

njrat hacked by hidden person discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Botnet

Hacked By HiDDen PerSOn

Mutex

97ced457d91da156e7db8367a158d7b9

Attributes

reg_key
97ced457d91da156e7db8367a158d7b9

Targets

- Target
  
  JaffaCakes118_c82090cb1238272ea71d0e1c46c925f7
- Size
  
  81KB
- MD5
  
  c82090cb1238272ea71d0e1c46c925f7
- SHA1
  
  ad35aff2b8541fd295c3acb2adb24d3551140750
- SHA256
  
  606938c343ff1eb7278561785855589f46b06dfbc6925b1bb2173d3722c9f393
- SHA512
  
  247ff4e5f59ab366c8bcc0135c66c53a4e6336bd653705296e20ef37342dde0f3511190e53e27e026911dfb9d95fe15e602121c763fbf37eefcc092fc78cb178
- SSDEEP
  
  1536:MGIFfmuPLEm3fo8w2oEramguwePcBMU+X6mmH7PNZwmwsOI7m3dUpbmh5O:jmQ8ww++/PcBMU+X6mu7PNZ6TtUAO
Score

10^/10

njrat hacked by hidden person discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathacked by hidden persondiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njrathacked by hidden persondiscoveryevasionpersistenceprivilege_escalationtrojan