njrat | 7db30cf4697f11f564a130c1c24aeeb7d66ef58db98c7662001305925fa282a5 | Triage

Sharing

General

Target

7db30cf4697f11f564a130c1c24aeeb7d66ef58db98c7662001305925fa282a5.exe
Size

257KB
Sample

250122-elyjgaxrak
MD5

cb27527be7e983bde63b39abdedbc75a
SHA1

4321b26037a08949674b211807ca411e0761f5e7
SHA256

7db30cf4697f11f564a130c1c24aeeb7d66ef58db98c7662001305925fa282a5
SHA512

bab9cc7628b2e774ba01fb8d7875cb754a42cbc88d7c02c3c91badfe0f02c3b6bb4ecfe4cdb7e47dac8dcff38ffa60fb60d44399cc50ab0f903544e3d7675f5f
SSDEEP

6144:vY4AymXSWEM1TOzeUh6+/Igohbkk5S98Bw:v7S5H1izlX9oOGBw

Score

10^/10

njrat defense_evasion persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  7db30cf4697f11f564a130c1c24aeeb7d66ef58db98c7662001305925fa282a5.exe
- Size
  
  257KB
- MD5
  
  cb27527be7e983bde63b39abdedbc75a
- SHA1
  
  4321b26037a08949674b211807ca411e0761f5e7
- SHA256
  
  7db30cf4697f11f564a130c1c24aeeb7d66ef58db98c7662001305925fa282a5
- SHA512
  
  bab9cc7628b2e774ba01fb8d7875cb754a42cbc88d7c02c3c91badfe0f02c3b6bb4ecfe4cdb7e47dac8dcff38ffa60fb60d44399cc50ab0f903544e3d7675f5f
- SSDEEP
  
  6144:vY4AymXSWEM1TOzeUh6+/Igohbkk5S98Bw:v7S5H1izlX9oOGBw
Score

10^/10

njrat defense_evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdefense_evasionpersistenceprivilege_escalationtrojan

behavioral2

njratdefense_evasionpersistenceprivilege_escalationtrojan