njrat | c8c178ffceaad0b87503d1045d2dc6f7fe431ed08b86a9a210b4b0325a401a8d | Triage

Sharing

General

Target

EncryptSynaptics2.com
Size

52KB
Sample

200731-ezhryctkmn
MD5

83b20ab12a5ca0b41d5af87122007501
SHA1

1498292fd549c6b32b9d6361ddd474a7997ea46c
SHA256

c8c178ffceaad0b87503d1045d2dc6f7fe431ed08b86a9a210b4b0325a401a8d
SHA512

fae04c88544bf8bd68f4fa9925750e1f5b9630f11870e844d7bea48016611e3a2d7ffd218a293fde5a30b4861f915750c2c2f99696e55db3d4a459103856c740

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  EncryptSynaptics2.com
- Size
  
  52KB
- MD5
  
  83b20ab12a5ca0b41d5af87122007501
- SHA1
  
  1498292fd549c6b32b9d6361ddd474a7997ea46c
- SHA256
  
  c8c178ffceaad0b87503d1045d2dc6f7fe431ed08b86a9a210b4b0325a401a8d
- SHA512
  
  fae04c88544bf8bd68f4fa9925750e1f5b9630f11870e844d7bea48016611e3a2d7ffd218a293fde5a30b4861f915750c2c2f99696e55db3d4a459103856c740
Score

10^/10

evasion persistence trojan njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
  persistence
- Modifies service
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistencetrojannjrat

behavioral2

evasionpersistencetrojannjrat