njrat | a642b23358d9dafb9bf499669eba69230c01a66c63fcf7f50f6f517cd5216d46 | Triage™

Login
Reports

Overview

overview

Static

static

Server.exe

windows10-2004-x64

Server.exe

windows11-ltsc_2024-x64

Sharing

Copy URL Twitter E-mail

General

Target
Server.exe
Size 23KB
Sample260701-tcvtjsbv7s
SHA256 a642b23358d9dafb9bf499669eba69230c01a66c63fcf7f50f6f517cd5216d46
MD5 7e538633ff4ce072f1b42ebac9f3d500
SHA1 36fa49f9fb7833072bec6fd763fbf4fde49371b0
SHA512 7a69908e4e1528c3c986dacc485777114d5079f4e0b3a748fd590fe86064648d8150842a469d8822d9bd8104d631ba057933c21a695f97ade301aa8686b0abf8
SSDEEP 384:/+n2650N3qZbATcjRGC5Eo9D46BgnqUhay19mRvR6JZlbw8hqIusZzZVMsc/:Ym+71d5bRpcnueMsK
TLSH
T1D9B22B4E3FA98856C5BC177486B6965043B0A1470413EE2FCCC564DBAFB3AD92D4CAF8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

njrat ضحيه defense_evasion discovery persistence privilege_escalation trojan

Static task

static1

2 signatures

ضحيه trojan njrat

Behavioral task

behavioral1

Sample

Server.exe

Resource

win10v2004-20260513-en

windows10-2004-x64

8 signatures

150 seconds

defense_evasion discovery njrat persistence privilege_escalation trojan

Behavioral task

behavioral2

Sample

Server.exe

Resource

win11ltsc2024-20260629-en

windows11-ltsc_2024-x64

8 signatures

150 seconds

defense_evasion discovery njrat persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

ضحيه

C2

portbuddy.dev:43082

Mutex

4a57dfb33a0462ee5413754595ecb42c

Attributes

reg_key
4a57dfb33a0462ee5413754595ecb42c
splitter
|'|'|

Targets

- Target
  Server.exe
- Size 23KB
- SHA256 a642b23358d9dafb9bf499669eba69230c01a66c63fcf7f50f6f517cd5216d46
- MD5 7e538633ff4ce072f1b42ebac9f3d500
- SHA1 36fa49f9fb7833072bec6fd763fbf4fde49371b0
- SHA512 7a69908e4e1528c3c986dacc485777114d5079f4e0b3a748fd590fe86064648d8150842a469d8822d9bd8104d631ba057933c21a695f97ade301aa8686b0abf8
- SSDEEP 384:/+n2650N3qZbATcjRGC5Eo9D46BgnqUhay19mRvR6JZlbw8hqIusZzZVMsc/:Ym+71d5bRpcnueMsK
- TLSH
  T1D9B22B4E3FA98856C5BC177486B6965043B0A1470413EE2FCCC564DBAFB3AD92D4CAF8
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery njrat persistence privilege_escalation trojan
- Family: njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  defense_evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

ضحيهtrojannjrat

behavioral1

defense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

behavioral2

defense_evasiondiscoverynjratpersistenceprivilege_escalationtrojan

© 2018-2026

Terms | Privacy