njrat | 077add2a67e789f901026537d210ea7c006befd4e2b0310ad24e1e7d4325f875 | Triage

Sharing

General

Target

077add2a67e789f901026537d210ea7c006befd4e2b0310ad24e1e7d4325f875
Size

72KB
Sample

250124-x71vtstrfy
MD5

01e047ffa60c8c02176cfbb45c97e5ea
SHA1

93366c1c6205f2d57c0560159776f58536ee0c0b
SHA256

077add2a67e789f901026537d210ea7c006befd4e2b0310ad24e1e7d4325f875
SHA512

f57e7ab67dd9337e00ed7c399a6ba3d0d89adc4f0d0ee1751ed1594cf3ba1adbfa95c9963bdf9db92a3fae56ca9c6c8ad46649284434834f78ee65754dd99d99
SSDEEP

1536:rdsjgC5g3rPzNQeSX2qkctB6Vq9RTRAgp4x4P/7Am9m:rdteg3rRQeSXdk+8qVHaeP/7AK

Score

10^/10

njrat defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Targets

- Target
  
  077add2a67e789f901026537d210ea7c006befd4e2b0310ad24e1e7d4325f875
- Size
  
  72KB
- MD5
  
  01e047ffa60c8c02176cfbb45c97e5ea
- SHA1
  
  93366c1c6205f2d57c0560159776f58536ee0c0b
- SHA256
  
  077add2a67e789f901026537d210ea7c006befd4e2b0310ad24e1e7d4325f875
- SHA512
  
  f57e7ab67dd9337e00ed7c399a6ba3d0d89adc4f0d0ee1751ed1594cf3ba1adbfa95c9963bdf9db92a3fae56ca9c6c8ad46649284434834f78ee65754dd99d99
- SSDEEP
  
  1536:rdsjgC5g3rPzNQeSX2qkctB6Vq9RTRAgp4x4P/7Am9m:rdteg3rRQeSXdk+8qVHaeP/7AK
Score

10^/10

njrat defense_evasion discovery persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdefense_evasiondiscoverypersistenceprivilege_escalationtrojan

behavioral2

njratdefense_evasiondiscoverypersistenceprivilege_escalationtrojan