njrat | a5aef3acca2d2aa07bd312cb8a58b4bf8dd4aed42fe5d8aaefbb6df9dcb813e5 | Triage™

Login
Reports

Overview

overview

Static

static

a0ba3b8923...18.exe

windows10-2004-x64

a0ba3b8923...18.exe

windows11-21h2-x64

Sharing

Copy URL Twitter E-mail

General

Target
a0ba3b892379b7e67d1656b116730318.exe
Size 31KB
Sample250526-ane3paxry7
SHA256 a5aef3acca2d2aa07bd312cb8a58b4bf8dd4aed42fe5d8aaefbb6df9dcb813e5
MD5 a0ba3b892379b7e67d1656b116730318
SHA1 789829095d78249f078b6b1976321b3ce3e1f5df
SHA512 027c2b1120cdaa2e187f83b2a6a1928e09ad576eba014bfeb65a783b082a9f0c562c55c2a8913c4c3fdb478b6742a28afc9eb0380147174804cfdbfc9fa887a6
SSDEEP 768:og5CUKdTtrUzxf6vQI2zb39v9rQmIDUu0tiJEj:3aoJpxQVkDj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat otariozao defense_evasion discovery persistence privilege_escalation trojan

Static task

static1

2 signatures

otariozao njrat

Behavioral task

behavioral1

Sample

a0ba3b892379b7e67d1656b116730318.exe

Resource

win10v2004-20250502-en

windows10-2004-x64

9 signatures

150 seconds

njrat defense_evasion discovery persistence privilege_escalation trojan

Behavioral task

behavioral2

Sample

a0ba3b892379b7e67d1656b116730318.exe

Resource

win11-20250508-en

windows11-21h2-x64

9 signatures

150 seconds

njrat defense_evasion discovery persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Otariozao

C2

radio-boating.gl.at.ply.gg:39881

Mutex

72d3b1e6221d57bd5d15ffb4a28a4cbe

Attributes

reg_key
72d3b1e6221d57bd5d15ffb4a28a4cbe
splitter
Y262SUCZ4UJJ

Targets

- Target
  a0ba3b892379b7e67d1656b116730318.exe
- Size 31KB
- SHA256 a5aef3acca2d2aa07bd312cb8a58b4bf8dd4aed42fe5d8aaefbb6df9dcb813e5
- MD5 a0ba3b892379b7e67d1656b116730318
- SHA1 789829095d78249f078b6b1976321b3ce3e1f5df
- SHA512 027c2b1120cdaa2e187f83b2a6a1928e09ad576eba014bfeb65a783b082a9f0c562c55c2a8913c4c3fdb478b6742a28afc9eb0380147174804cfdbfc9fa887a6
- SSDEEP 768:og5CUKdTtrUzxf6vQI2zb39v9rQmIDUu0tiJEj:3aoJpxQVkDj
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

njrat defense_evasion discovery persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratdefense_evasiondiscoverypersistenceprivilege_escalationtrojan

behavioral2

njratdefense_evasiondiscoverypersistenceprivilege_escalationtrojan

© 2018-2026

Terms | Privacy