njrat | 72fd107044ae159a7a80813fe902a132f12eedd01c63fd9e506cf05e088e7491 | Triage™

Login
Reports

Overview

overview

Static

static

Backdoor.M...nt.exe

windows10-2004-x64

Backdoor.M...nt.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
Backdoor.MSIL.Agent.jdt-72fd107044ae159a7a80813fe902a132f12eedd01c63fd9e506cf05e088e7491
Size 89KB
Sample260620-qlacesgv8y
SHA256 72fd107044ae159a7a80813fe902a132f12eedd01c63fd9e506cf05e088e7491
MD5 f54eea2b9a7c0259b87a5303a526d818
SHA1 641fcc96b0e288f7c5b1d0b94d6be1be2939e38e
SHA512 36d1fb8553f454b1edbd719d4805e3d120b243960fb82ff640e52e3d3c9710a8761128079f981da011ad931c1117c0d7317f051bd4fd71a5bad93b7862dafde5
SSDEEP 384:W8aZYC9twBNdcvFaly2H0dbJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZVPe+8tp:AY+sNKqNHnSdRpcnu+REgTK
TLSH
T1FC936E4A3E7844CFCF6D123099A1925042F36C0B291EAD59EFC0718F99BEDD59834ABD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

njrat low3n defense_evasion discovery persistence privilege_escalation trojan

Static task

static1

2 signatures

low3n trojan njrat

Behavioral task

behavioral1

Sample

Backdoor.MSIL.Agent.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

8 signatures

60 seconds

defense_evasion discovery njrat persistence privilege_escalation trojan

Behavioral task

behavioral2

Sample

Backdoor.MSIL.Agent.exe

Resource

win11ltsc2024-20260618-en

windows11-ltsc_2024-x64

8 signatures

60 seconds

defense_evasion discovery njrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

Low3n

C2

192.168.100.58:443

Mutex

e4c7f2e5b82fac0d624ab661f39b28fa

Attributes

reg_key
e4c7f2e5b82fac0d624ab661f39b28fa
splitter
|'|'|

Targets

- Target
  Backdoor.MSIL.Agent.jdt-72fd107044ae159a7a80813fe902a132f12eedd01c63fd9e506cf05e088e7491
- Size 89KB
- SHA256 72fd107044ae159a7a80813fe902a132f12eedd01c63fd9e506cf05e088e7491
- MD5 f54eea2b9a7c0259b87a5303a526d818
- SHA1 641fcc96b0e288f7c5b1d0b94d6be1be2939e38e
- SHA512 36d1fb8553f454b1edbd719d4805e3d120b243960fb82ff640e52e3d3c9710a8761128079f981da011ad931c1117c0d7317f051bd4fd71a5bad93b7862dafde5
- SSDEEP 384:W8aZYC9twBNdcvFaly2H0dbJo6HghcASEJqc/ZmRvR6JZlbw8hqIusZzZVPe+8tp:AY+sNKqNHnSdRpcnu+REgTK
- TLSH
  T1FC936E4A3E7844CFCF6D123099A1925042F36C0B291EAD59EFC0718F99BEDD59834ABD
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery njrat persistence privilege_escalation trojan
- Family: njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

low3ntrojannjrat

behavioral1

defense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

behavioral2

defense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

© 2018-2026

Terms | Privacy