njrat | 62af3932f71be7c5b9e66513db818c230999323a36c1967cfb6ee72414c4ba51 | Triage

Sharing

General

Target

62af3932f71be7c5b9e66513db818c230999323a36c1967cfb6ee72414c4ba51N.exe
Size

288KB
Sample

250122-dkpz9svmdv
MD5

6e75f0291147c694689bfec9afd67240
SHA1

90e1d7f3fafb8d22aea7236d1b58f8c0a79c84c2
SHA256

62af3932f71be7c5b9e66513db818c230999323a36c1967cfb6ee72414c4ba51
SHA512

3f734d44ee93b50f4e7f14dfec45d1963804767e29bbadbf35836bde66f89a3ebfdef2e369227b471415feab231c583f1f7974054c9be0207949b5349ea2fc3e
SSDEEP

6144:swn0V1pukGg2CMIBAAgBNGWyv6oh7e5t:Ny1DsgAAX2o

Score

10^/10

njrat defense_evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  62af3932f71be7c5b9e66513db818c230999323a36c1967cfb6ee72414c4ba51N.exe
- Size
  
  288KB
- MD5
  
  6e75f0291147c694689bfec9afd67240
- SHA1
  
  90e1d7f3fafb8d22aea7236d1b58f8c0a79c84c2
- SHA256
  
  62af3932f71be7c5b9e66513db818c230999323a36c1967cfb6ee72414c4ba51
- SHA512
  
  3f734d44ee93b50f4e7f14dfec45d1963804767e29bbadbf35836bde66f89a3ebfdef2e369227b471415feab231c583f1f7974054c9be0207949b5349ea2fc3e
- SSDEEP
  
  6144:swn0V1pukGg2CMIBAAgBNGWyv6oh7e5t:Ny1DsgAAX2o
Score

10^/10

njrat defense_evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdefense_evasionpersistenceprivilege_escalationtrojan

behavioral2

njratdefense_evasionpersistenceprivilege_escalationtrojan