njrat | a73f7e943e0e64e0b56d76c49f37af92fcade426b17523d326ee34b2b084148b | Triage™

Login
Reports

Overview

overview

Static

static

Server.exe

windows10-2004-x64

Server.exe

windows11-21h2-x64

Sharing

Copy URL Twitter E-mail

General

Target
Server.exe
Size 37KB
Sample251006-jtztqaxtat
SHA256 a73f7e943e0e64e0b56d76c49f37af92fcade426b17523d326ee34b2b084148b
MD5 a5e5fec1ba60d47115aba4b37ecd8458
SHA1 53490134426afa472d8073ebfbb3ed330452f217
SHA512 bf9cd66421de15502920d8d1348bc174fc1e0ec8901ac5a879c4d72e60267a6eebe5fd3aef89474b2747e274573f40f1ca4b0fe4faeec63f943259b624ba9eef
SSDEEP 384:zd4Nb7LsikZ9zNf/1uyU71evdL9sOaPJrAF+rMRTyN/0L+EcoinblneHQM3epzX4:SNf4l1lU71eZ9FaxrM+rMRa8NutMt
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat hacked defense_evasion discovery persistence privilege_escalation trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

Server.exe

Resource

win10v2004-20250610-en

windows10-2004-x64

9 signatures

150 seconds

hacked defense_evasion discovery njrat persistence privilege_escalation trojan

Behavioral task

behavioral2

Sample

Server.exe

Resource

win11-20250619-en

windows11-21h2-x64

9 signatures

150 seconds

hacked defense_evasion discovery njrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

lsoj0-51746.portmap.host:51746

Mutex

a417975443fe2f124ddb6f93ff249af4

Attributes

reg_key
a417975443fe2f124ddb6f93ff249af4
splitter
|'|'|

Targets

- Target
  Server.exe
- Size 37KB
- SHA256 a73f7e943e0e64e0b56d76c49f37af92fcade426b17523d326ee34b2b084148b
- MD5 a5e5fec1ba60d47115aba4b37ecd8458
- SHA1 53490134426afa472d8073ebfbb3ed330452f217
- SHA512 bf9cd66421de15502920d8d1348bc174fc1e0ec8901ac5a879c4d72e60267a6eebe5fd3aef89474b2747e274573f40f1ca4b0fe4faeec63f943259b624ba9eef
- SSDEEP 384:zd4Nb7LsikZ9zNf/1uyU71evdL9sOaPJrAF+rMRTyN/0L+EcoinblneHQM3epzX4:SNf4l1lU71eZ9FaxrM+rMRa8NutMt
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

hacked defense_evasion discovery njrat persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

hackeddefense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

behavioral2

hackeddefense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

© 2018-2026

Terms | Privacy