njrat | 9fda1a08e9333196ddcce35ba341a1c4de4656075fe0842fa99acd0c1be20945 | Triage

Sharing

General

Target

9fda1a08e9333196ddcce35ba341a1c4de4656075fe0842fa99acd0c1be20945
Size

22KB
Sample

250114-xs95yswnct
MD5

9a8917da9033a8b24506acc1d15f4a9b
SHA1

080507306fec6b87cf8223087417f480ad4f03e7
SHA256

9fda1a08e9333196ddcce35ba341a1c4de4656075fe0842fa99acd0c1be20945
SHA512

f693ad71d77267d9879dae88ae3ae8a682686cbc60455e0fd06653653cf1d8250bc081744a49bd937b21134ea719d2148c4e187eb8a5ac04e0c23c431bf3477e
SSDEEP

384:M9+n2650N3qZbATcjRGC5EowD46BgnqUhay19mRvR6JZlbw8hqIusZzZzr:Mim+71d5ARpcnuQ

Score

10^/10

njrat bypassmm discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

bypassmm

C2

127.0.0.1:3158

Mutex

7d3bf60db30b800b77fa3aa9ed9ed5c8

Attributes

reg_key
7d3bf60db30b800b77fa3aa9ed9ed5c8
splitter
|'|'|

Targets

- Target
  
  9fda1a08e9333196ddcce35ba341a1c4de4656075fe0842fa99acd0c1be20945
- Size
  
  22KB
- MD5
  
  9a8917da9033a8b24506acc1d15f4a9b
- SHA1
  
  080507306fec6b87cf8223087417f480ad4f03e7
- SHA256
  
  9fda1a08e9333196ddcce35ba341a1c4de4656075fe0842fa99acd0c1be20945
- SHA512
  
  f693ad71d77267d9879dae88ae3ae8a682686cbc60455e0fd06653653cf1d8250bc081744a49bd937b21134ea719d2148c4e187eb8a5ac04e0c23c431bf3477e
- SSDEEP
  
  384:M9+n2650N3qZbATcjRGC5EowD46BgnqUhay19mRvR6JZlbw8hqIusZzZzr:Mim+71d5ARpcnuQ
Score

10^/10

njrat discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratdiscoveryevasionpersistenceprivilege_escalationtrojan