njrat | b20ffc1d22dbcae7052b7414d7ed19303ec13f419d41dd976806de7f86bc9b31 | Triage

Sharing

General

Target

SecuriteInfo.com.Trojan.Emotet.987.23049.3767
Size

36KB
Sample

200801-ntld9bpf3e
MD5

f1f8814239371bbaa60f2d2bced185e4
SHA1

117dea564d6f7ed5c6741b8fd5a87bcac5765722
SHA256

b20ffc1d22dbcae7052b7414d7ed19303ec13f419d41dd976806de7f86bc9b31
SHA512

4b3a0f5029544a3b94d735a2c609fce17fad47e9d9bfb210b68eb0da1e572e6831492317415b2bcf23c542fa024e50a1fe44d5586d8c9a855003090e1d87a87c

Score

10^/10

njrat evasion persistence trojan

Malware Config

Targets

- Target
  
  SecuriteInfo.com.Trojan.Emotet.987.23049.3767
- Size
  
  36KB
- MD5
  
  f1f8814239371bbaa60f2d2bced185e4
- SHA1
  
  117dea564d6f7ed5c6741b8fd5a87bcac5765722
- SHA256
  
  b20ffc1d22dbcae7052b7414d7ed19303ec13f419d41dd976806de7f86bc9b31
- SHA512
  
  4b3a0f5029544a3b94d735a2c609fce17fad47e9d9bfb210b68eb0da1e572e6831492317415b2bcf23c542fa024e50a1fe44d5586d8c9a855003090e1d87a87c
Score

10^/10

evasion persistence trojan njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Executes dropped EXE
- Modifies Windows Firewall
  evasion
- Loads dropped DLL
- Legitimate hosting services abused for malware hosting/C2
- Modifies service
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

evasionpersistencetrojannjrat

behavioral2

evasiontrojannjrat