njrat | a216cfb7ba787b97292d64d6bd5301aa0b0df32864d57b401479d23fbbeeb245 | Triage

Sharing

General

Target

BootstrapperTest.exe
Size

165KB
Sample

250124-tzwpcsynar
MD5

919f0936ab4ba5e37418b09e38cf085b
SHA1

614806a90396d99091a2359f58d883ac6365f91c
SHA256

a216cfb7ba787b97292d64d6bd5301aa0b0df32864d57b401479d23fbbeeb245
SHA512

27c7a07b1f99627ff0346833287bb539dcece522f2db625ba55abdb16420ba982a8b4404957b050dcbff247c91dfeecb7167defeb417007755c1fcd10f7f71b8
SSDEEP

3072:Y6Vy/xsmY7PpyPg2dKb6VDs2j2liGE+gmJhbMZsSxUrTF:Y6nQVb4ZiVzmjb8xU

Score

10^/10

njrat discovery persistence trojan

Malware Config

Targets

- Target
  
  BootstrapperTest.exe
- Size
  
  165KB
- MD5
  
  919f0936ab4ba5e37418b09e38cf085b
- SHA1
  
  614806a90396d99091a2359f58d883ac6365f91c
- SHA256
  
  a216cfb7ba787b97292d64d6bd5301aa0b0df32864d57b401479d23fbbeeb245
- SHA512
  
  27c7a07b1f99627ff0346833287bb539dcece522f2db625ba55abdb16420ba982a8b4404957b050dcbff247c91dfeecb7167defeb417007755c1fcd10f7f71b8
- SSDEEP
  
  3072:Y6Vy/xsmY7PpyPg2dKb6VDs2j2liGE+gmJhbMZsSxUrTF:Y6nQVb4ZiVzmjb8xU
Score

10^/10

njrat discovery persistence trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Probable phishing domain
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

Execution

Scheduled Task/Job

Scheduled Task

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Scheduled Task

Defense Evasion

Modify Registry

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdiscoverypersistencetrojan

behavioral2

njratdiscoverypersistencetrojan