njrat | 45a70728e0d5c32ab6b1c3b4ddd0a6b1ec2e62c9cb3cc3f8ef1f4eabb6ace928 | Triage

Sharing

General

Target

45a70728e0d5c32ab6b1c3b4ddd0a6b1ec2e62c9cb3cc3f8ef1f4eabb6ace928.exe
Size

23KB
Sample

250206-g6ps6sxqdq
MD5

43f8d95b14a04307b1a1455981ade506
SHA1

57572c8132a8452c2c8f7af546859ffcc7795ed8
SHA256

45a70728e0d5c32ab6b1c3b4ddd0a6b1ec2e62c9cb3cc3f8ef1f4eabb6ace928
SHA512

ced4ed557c7b22c1c273992eaf33182efcb15df6e5bf4cc7a0582d12c70ebfc100abe90224ab10702d247eca0d56ce4a2818c918210b35d8c4820e1f7415d6f6
SSDEEP

384:GV+n2650N3qZbATcjRGC5EowD46BgnqUhay1ZmRvR6JZlbw8hqIusZzZudN:Gam+71d5cRpcnuHz

Score

10^/10

njrat hacked defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hextoriq99.ddns.net:443

Mutex

c5b300e02cf114ab7264097febaa3f9c

Attributes

reg_key
c5b300e02cf114ab7264097febaa3f9c
splitter
|'|'|

Targets

- Target
  
  45a70728e0d5c32ab6b1c3b4ddd0a6b1ec2e62c9cb3cc3f8ef1f4eabb6ace928.exe
- Size
  
  23KB
- MD5
  
  43f8d95b14a04307b1a1455981ade506
- SHA1
  
  57572c8132a8452c2c8f7af546859ffcc7795ed8
- SHA256
  
  45a70728e0d5c32ab6b1c3b4ddd0a6b1ec2e62c9cb3cc3f8ef1f4eabb6ace928
- SHA512
  
  ced4ed557c7b22c1c273992eaf33182efcb15df6e5bf4cc7a0582d12c70ebfc100abe90224ab10702d247eca0d56ce4a2818c918210b35d8c4820e1f7415d6f6
- SSDEEP
  
  384:GV+n2650N3qZbATcjRGC5EowD46BgnqUhay1ZmRvR6JZlbw8hqIusZzZudN:Gam+71d5cRpcnuHz
Score

10^/10

njrat defense_evasion discovery persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdefense_evasiondiscoverypersistenceprivilege_escalationtrojan

behavioral2

njratdefense_evasiondiscoverypersistenceprivilege_escalationtrojan