njrat | 303e50eedde67084f95ddebe57469c5621afca239339617f3c40a472b6978409 | Triage

Sharing

General

Target

303e50eedde67084f95ddebe57469c5621afca239339617f3c40a472b6978409.exe
Size

105KB
Sample

250113-j12a5awqdm
MD5

7d952d70075a38d4316041dccf4046f3
SHA1

d334551e25dfbbedc6c711ae903f17b3e99fbb75
SHA256

303e50eedde67084f95ddebe57469c5621afca239339617f3c40a472b6978409
SHA512

ad0ff23a91f30211bd9d80133d1f8ea82dda759eac0b0b16be3d56f84f43c0c2a9340c820a620c305fee8ce75aaef903d303f779fe895c5412cbd2ee82673d0f
SSDEEP

1536:YoI1pcgHx5FLZZf/L6dvHcnNh58m3BTgWRPVo4oEB7hBmiua39d2/xOcXp46JpVh:zIzc+Tul0Nh3RUMCE9qaOxbtpVEP0

Score

10^/10

njrat test evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Test

C2

127.0.0.1:1616

Mutex

e34861c344caaad773c61f8376b103c3

Attributes

reg_key
e34861c344caaad773c61f8376b103c3
splitter
!^|!^

Targets

- Target
  
  303e50eedde67084f95ddebe57469c5621afca239339617f3c40a472b6978409.exe
- Size
  
  105KB
- MD5
  
  7d952d70075a38d4316041dccf4046f3
- SHA1
  
  d334551e25dfbbedc6c711ae903f17b3e99fbb75
- SHA256
  
  303e50eedde67084f95ddebe57469c5621afca239339617f3c40a472b6978409
- SHA512
  
  ad0ff23a91f30211bd9d80133d1f8ea82dda759eac0b0b16be3d56f84f43c0c2a9340c820a620c305fee8ce75aaef903d303f779fe895c5412cbd2ee82673d0f
- SSDEEP
  
  1536:YoI1pcgHx5FLZZf/L6dvHcnNh58m3BTgWRPVo4oEB7hBmiua39d2/xOcXp46JpVh:zIzc+Tul0Nh3RUMCE9qaOxbtpVEP0
Score

10^/10

njrat test evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrattestevasionpersistenceprivilege_escalationtrojan

behavioral2

njrattestevasionpersistenceprivilege_escalationtrojan