njrat | 1f0b950ecfeec6a65bc660a7be047f417cbbfeedce8425b962add10c77e5342a | Triage

Sharing

General

Target

Server.exe
Size

37KB
Sample

250128-wpv17axjfv
MD5

8c4c96d00338879082b506bd938d0ba1
SHA1

bc0a286cf54fb47403eb48e710d953737313c5f9
SHA256

1f0b950ecfeec6a65bc660a7be047f417cbbfeedce8425b962add10c77e5342a
SHA512

344695ce36ab7637bdc32671c59fa9a02a8551576f645cb79ff670af2d0cd2078cf8f75be4830f8994d51e7e9757d762cde162c3a81a00d9e1b34f81065c80b2
SSDEEP

768:11kSdCNhszSDSMOxsIqrM+rMRa8NuXtxt:1iSdCNGySMOZV+gRJNS

Score

10^/10

njrat hacked defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

jmryry.zapto.org:5557

Mutex

47f10c56a5875be05373197659d2b186

Attributes

reg_key
47f10c56a5875be05373197659d2b186
splitter
|'|'|

Targets

- Target
  
  Server.exe
- Size
  
  37KB
- MD5
  
  8c4c96d00338879082b506bd938d0ba1
- SHA1
  
  bc0a286cf54fb47403eb48e710d953737313c5f9
- SHA256
  
  1f0b950ecfeec6a65bc660a7be047f417cbbfeedce8425b962add10c77e5342a
- SHA512
  
  344695ce36ab7637bdc32671c59fa9a02a8551576f645cb79ff670af2d0cd2078cf8f75be4830f8994d51e7e9757d762cde162c3a81a00d9e1b34f81065c80b2
- SSDEEP
  
  768:11kSdCNhszSDSMOxsIqrM+rMRa8NuXtxt:1iSdCNGySMOZV+gRJNS
Score

10^/10

njrat hacked defense_evasion discovery persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackeddefense_evasiondiscoverypersistenceprivilege_escalationtrojan

behavioral2

defense_evasiondiscoverypersistenceprivilege_escalation