njrat | cc749c708de955f129b1bf7ff198b28c906f6a233ac6dba95fe2acfd3009a32d | Triage

Sharing

General

Target

Gaming Chair.exe
Size

7.0MB
Sample

250122-tqzdwsvrfp
MD5

b97c8aab67e949a5e43905ceed9b0319
SHA1

5b9f0aa33a1e4e325370711d950fdf06b737993f
SHA256

cc749c708de955f129b1bf7ff198b28c906f6a233ac6dba95fe2acfd3009a32d
SHA512

e2c3a1773859c6e76a1dc155593ff96983cd1d499c4e9e3ff732027167d81b484c0d774652a7486e778b66b7abcb4d645b1d31c6b8199b95c4000ea6e7d40580
SSDEEP

98304:iSLCUGG+t+aCnfFXL/LNIRDB3YP1SnPWMO5RadDNkZCXA/G3Ra3Eql:8UGGw+zRIRFIP1Y+MooOHwRa3v

Score

10^/10

njrat defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  Gaming Chair.exe
- Size
  
  7.0MB
- MD5
  
  b97c8aab67e949a5e43905ceed9b0319
- SHA1
  
  5b9f0aa33a1e4e325370711d950fdf06b737993f
- SHA256
  
  cc749c708de955f129b1bf7ff198b28c906f6a233ac6dba95fe2acfd3009a32d
- SHA512
  
  e2c3a1773859c6e76a1dc155593ff96983cd1d499c4e9e3ff732027167d81b484c0d774652a7486e778b66b7abcb4d645b1d31c6b8199b95c4000ea6e7d40580
- SSDEEP
  
  98304:iSLCUGG+t+aCnfFXL/LNIRDB3YP1SnPWMO5RadDNkZCXA/G3Ra3Eql:8UGGw+zRIRFIP1Y+MooOHwRa3v
Score

10^/10

njrat defense_evasion discovery execution persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Stops running service(s)
  defense_evasion execution
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Hide Artifacts

Hidden Files and Directories

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

behavioral1

njratdefense_evasiondiscoveryexecutionpersistenceprivilege_escalationtrojan