njrat | f78d7407022b70ca8daf13b801a37befd4a3d1d9c42ace0852f7af04f3daf9f4 | Triage

Sharing

General

Target

f78d7407022b70ca8daf13b801a37befd4a3d1d9c42ace0852f7af04f3daf9f4.exe
Size

23KB
Sample

250205-qb8ggaxlgt
MD5

2561dc1287489e9ef913effe52a90a69
SHA1

74b6c4e170ac9c6a4a7dba11d8aff3fa5508108f
SHA256

f78d7407022b70ca8daf13b801a37befd4a3d1d9c42ace0852f7af04f3daf9f4
SHA512

3fc6b890b152bfad5845484534bab666a88f40777b8847fc41ff2d66c35ade10a9972858baf5e17b8d6eecf1a31301dbcb1b2eb8f3461ad2d50e416f47be2f90
SSDEEP

384:dY324bcgPiJLQrfARGSRUJsbY6vgvSMBD3t8mRvR6JZlbw8hqIusZzZLq:SL2s+tRARpcnu1

Score

10^/10

njrat hacked defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

rooom.zapto.org:5552

Mutex

bc2d64ebe0c37ce9e59fdd444e0c5b47

Attributes

reg_key
bc2d64ebe0c37ce9e59fdd444e0c5b47
splitter
|'|'|

Targets

- Target
  
  f78d7407022b70ca8daf13b801a37befd4a3d1d9c42ace0852f7af04f3daf9f4.exe
- Size
  
  23KB
- MD5
  
  2561dc1287489e9ef913effe52a90a69
- SHA1
  
  74b6c4e170ac9c6a4a7dba11d8aff3fa5508108f
- SHA256
  
  f78d7407022b70ca8daf13b801a37befd4a3d1d9c42ace0852f7af04f3daf9f4
- SHA512
  
  3fc6b890b152bfad5845484534bab666a88f40777b8847fc41ff2d66c35ade10a9972858baf5e17b8d6eecf1a31301dbcb1b2eb8f3461ad2d50e416f47be2f90
- SSDEEP
  
  384:dY324bcgPiJLQrfARGSRUJsbY6vgvSMBD3t8mRvR6JZlbw8hqIusZzZLq:SL2s+tRARpcnu1
Score

10^/10

njrat defense_evasion discovery persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdefense_evasiondiscoverypersistenceprivilege_escalationtrojan