njrat | 0d07cad3d0073bf9e627236199f773416b8de0c79391a9d4d1d238c7803ef12c | Triage

Sharing

General

Target

0d07cad3d0073bf9e627236199f773416b8de0c79391a9d4d1d238c7803ef12c.exe
Size

115KB
Sample

250201-w1hv1avjh1
MD5

6d8e70d54d39f18d8826ca669dd8918d
SHA1

65bd9ceda4a11114e9e760acd350fe22e6c789cf
SHA256

0d07cad3d0073bf9e627236199f773416b8de0c79391a9d4d1d238c7803ef12c
SHA512

19e92a97d4c1c78362cf244ab65e5604cd0e40b25c5212870a20f02f1e7b8d91a992fc1da4706fadc84ac9dc3fc9abd77612742fd863e74ba9fb97beeebef0bb
SSDEEP

3072:lHZ28rd2yNqfdcO6L0UQnICMce3SdJFhsz0HMib4O:l1dZnQIEei3Fhsz0MI

Score

10^/10

njrat hacked defense_evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

agdsagds.kro.kr:1111

Mutex

7bc5d4676f29fca15e68905e11aefcf9

Attributes

reg_key
7bc5d4676f29fca15e68905e11aefcf9
splitter
|'|'|

Targets

- Target
  
  0d07cad3d0073bf9e627236199f773416b8de0c79391a9d4d1d238c7803ef12c.exe
- Size
  
  115KB
- MD5
  
  6d8e70d54d39f18d8826ca669dd8918d
- SHA1
  
  65bd9ceda4a11114e9e760acd350fe22e6c789cf
- SHA256
  
  0d07cad3d0073bf9e627236199f773416b8de0c79391a9d4d1d238c7803ef12c
- SHA512
  
  19e92a97d4c1c78362cf244ab65e5604cd0e40b25c5212870a20f02f1e7b8d91a992fc1da4706fadc84ac9dc3fc9abd77612742fd863e74ba9fb97beeebef0bb
- SSDEEP
  
  3072:lHZ28rd2yNqfdcO6L0UQnICMce3SdJFhsz0HMib4O:l1dZnQIEei3Fhsz0MI
Score

10^/10

njrat hacked defense_evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackeddefense_evasionpersistenceprivilege_escalationtrojan

behavioral2

njrathackeddefense_evasionpersistenceprivilege_escalationtrojan