njrat | bc41bfef49ad75dc3e720a98495b8d6d0b82535e6b9371319abfc4ee9feccd9b | Triage

Sharing

General

Target

c79d7562344a4166e5a1e7698dc73ea5.exe
Size

93KB
Sample

250306-evc9wsxyay
MD5

c79d7562344a4166e5a1e7698dc73ea5
SHA1

bf03f7b156a359214bc405396d05442156d1cea2
SHA256

bc41bfef49ad75dc3e720a98495b8d6d0b82535e6b9371319abfc4ee9feccd9b
SHA512

1d618eab04172e3928b93a7aaa87f2358d4b04de2702ca315797471d1c34c66f6aa51042c5e1d17a3267c65bcfad3f969acc3f50c9b91d913027e922d996da6d
SSDEEP

1536:Xm9r7EkrjaFIs7E5Ox6Jn8LjEwzGi1dDFDogS:Xmhjau5OYVni1dpR

Score

10^/10

njrat hacked defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

day-snapshot.gl.at.ply.gg:32278

Mutex

9769439aab3af5938a7be71cb8c8805f

Attributes

reg_key
9769439aab3af5938a7be71cb8c8805f
splitter
|'|'|

Targets

- Target
  
  c79d7562344a4166e5a1e7698dc73ea5.exe
- Size
  
  93KB
- MD5
  
  c79d7562344a4166e5a1e7698dc73ea5
- SHA1
  
  bf03f7b156a359214bc405396d05442156d1cea2
- SHA256
  
  bc41bfef49ad75dc3e720a98495b8d6d0b82535e6b9371319abfc4ee9feccd9b
- SHA512
  
  1d618eab04172e3928b93a7aaa87f2358d4b04de2702ca315797471d1c34c66f6aa51042c5e1d17a3267c65bcfad3f969acc3f50c9b91d913027e922d996da6d
- SSDEEP
  
  1536:Xm9r7EkrjaFIs7E5Ox6Jn8LjEwzGi1dDFDogS:Xmhjau5OYVni1dpR
Score

10^/10

njrat hacked defense_evasion discovery persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrathackeddefense_evasiondiscoverypersistenceprivilege_escalationtrojan

behavioral2

defense_evasiondiscoverypersistenceprivilege_escalation