njrat | 3a080b9e573b71d2e22a75b331fb812c6efc051f474b13a90a0130ebb80a9fd0 | Triage

Sharing

General

Target

3a080b9e573b71d2e22a75b331fb812c6efc051f474b13a90a0130ebb80a9fd0.exe
Size

543KB
Sample

250121-c64vwaskdn
MD5

fb68b3125b564bca9edbcd0efb29f6fd
SHA1

254ea9b87924293760c762f9d718f5dbe3817d4e
SHA256

3a080b9e573b71d2e22a75b331fb812c6efc051f474b13a90a0130ebb80a9fd0
SHA512

4238deca48982e443599863cb6df8378204a8fba8cac1f261f68cd0aa1e2a86575bb196a58c409a26a46833793ca6494a293fda15d7a6d8651f45de2efe54ed2
SSDEEP

12288:lzomalyw9qfcaF52WgAIsAxOfqV42Rqol0M0pMsRNQSJGmENwMpA:VoigAm3lTah

Score

10^/10

njrat victim discovery trojan

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

Victim

C2

burhanalassad.duckdns.org:963

Mutex

svchost.exe

Attributes

reg_key
svchost.exe
splitter
|Ghost|

Targets

- Target
  
  3a080b9e573b71d2e22a75b331fb812c6efc051f474b13a90a0130ebb80a9fd0.exe
- Size
  
  543KB
- MD5
  
  fb68b3125b564bca9edbcd0efb29f6fd
- SHA1
  
  254ea9b87924293760c762f9d718f5dbe3817d4e
- SHA256
  
  3a080b9e573b71d2e22a75b331fb812c6efc051f474b13a90a0130ebb80a9fd0
- SHA512
  
  4238deca48982e443599863cb6df8378204a8fba8cac1f261f68cd0aa1e2a86575bb196a58c409a26a46833793ca6494a293fda15d7a6d8651f45de2efe54ed2
- SSDEEP
  
  12288:lzomalyw9qfcaF52WgAIsAxOfqV42Rqol0M0pMsRNQSJGmENwMpA:VoigAm3lTah
Score

10^/10

njrat victim discovery trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratvictimdiscoverytrojan

behavioral2

njratvictimdiscoverytrojan