njrat | de0d8ccd473794aaf8502f983cf83b5f840a5b3b4c84065ea2d5dd037ebad2a4 | Triage

Sharing

General

Target

de0d8ccd473794aaf8502f983cf83b5f840a5b3b4c84065ea2d5dd037ebad2a4
Size

23KB
Sample

250326-nvst1sswhv
MD5

220204d3ebce0a94144b3efc54d86339
SHA1

4e9c0f896bd499ac75ea22273960e7b0244316c5
SHA256

de0d8ccd473794aaf8502f983cf83b5f840a5b3b4c84065ea2d5dd037ebad2a4
SHA512

8b8f4b126b03d0a55a9af1590ce7ea250bc91ce5477e7c96834373af712bd958d443642dbcc9b8623b249296122f177a915b2ffb133bfa7380f5cda0efec00d5
SSDEEP

384:WQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZch:B5yBVd7Rpcnuv

Score

10^/10

njrat >_<defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

>_<

C2

hhnnss.ddns.net:5552

Mutex

6e7d69d3654f1ba5f22f7d513581ae9c

Attributes

reg_key
6e7d69d3654f1ba5f22f7d513581ae9c
splitter
|'|'|

Targets

- Target
  
  de0d8ccd473794aaf8502f983cf83b5f840a5b3b4c84065ea2d5dd037ebad2a4
- Size
  
  23KB
- MD5
  
  220204d3ebce0a94144b3efc54d86339
- SHA1
  
  4e9c0f896bd499ac75ea22273960e7b0244316c5
- SHA256
  
  de0d8ccd473794aaf8502f983cf83b5f840a5b3b4c84065ea2d5dd037ebad2a4
- SHA512
  
  8b8f4b126b03d0a55a9af1590ce7ea250bc91ce5477e7c96834373af712bd958d443642dbcc9b8623b249296122f177a915b2ffb133bfa7380f5cda0efec00d5
- SSDEEP
  
  384:WQeCo2zmZbQHkJeCdUwBvQ61gjuQBnB9mRvR6JZlbw8hqIusZzZch:B5yBVd7Rpcnuv
Score

10^/10

njrat >_<defense_evasion discovery persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njrat>_<defense_evasiondiscoverypersistenceprivilege_escalationtrojan

behavioral2

njratdefense_evasiondiscoverypersistenceprivilege_escalationtrojan