njrat | ccaa9f9e4a61111b9814917dcb9703768743dffc8faec938bc480c7b091c33dc | Triage™

Login
Reports

Overview

overview

Static

static

22c54abbde...a9.exe

windows7-x64

22c54abbde...a9.exe

windows10-2004-x64

Sharing

Copy URL Twitter E-mail

General

Target
22c54abbde95e1f240a8a65343e6faa9.exe
Size 31KB
Sample241118-fa359aykd1
SHA256 ccaa9f9e4a61111b9814917dcb9703768743dffc8faec938bc480c7b091c33dc
MD5 22c54abbde95e1f240a8a65343e6faa9
SHA1 8f6727a8ea3977e1f5fbea78c1390d6cc8a1b36a
SHA512 86ab53c341cc671e6b8d57bcb12a1f4337e6d36f5586480ec4a90234d73780626020582ea72c9a381392d0f54d6fa9a0f03b0f3d83b32c97c227899e9f40e171
SSDEEP 768:8J8R5d5rLmzxBuJRSae8H5LPvyQQmIDUu0tiroj:DvKmpj3QVktj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

njrat mpg discovery evasion persistence privilege_escalation trojan

Static task

static1

2 signatures

Behavioral task

behavioral1

Sample

22c54abbde95e1f240a8a65343e6faa9.exe

Resource

win7-20241023-en

windows7-x64

7 signatures

150 seconds

njrat mpg discovery evasion persistence privilege_escalation trojan

Behavioral task

behavioral2

Sample

22c54abbde95e1f240a8a65343e6faa9.exe

Resource

win10v2004-20241007-en

windows10-2004-x64

7 signatures

150 seconds

njrat mpg discovery evasion persistence privilege_escalation trojan

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

MPG

C2

49.228.131.165:2422

Mutex

fa6b40864b6c109adbc85023cd1f59d2

Attributes

reg_key
fa6b40864b6c109adbc85023cd1f59d2
splitter
Y262SUCZ4UJJ

Targets

- Target
  22c54abbde95e1f240a8a65343e6faa9.exe
- Size 31KB
- SHA256 ccaa9f9e4a61111b9814917dcb9703768743dffc8faec938bc480c7b091c33dc
- MD5 22c54abbde95e1f240a8a65343e6faa9
- SHA1 8f6727a8ea3977e1f5fbea78c1390d6cc8a1b36a
- SHA512 86ab53c341cc671e6b8d57bcb12a1f4337e6d36f5586480ec4a90234d73780626020582ea72c9a381392d0f54d6fa9a0f03b0f3d83b32c97c227899e9f40e171
- SSDEEP 768:8J8R5d5rLmzxBuJRSae8H5LPvyQQmIDUu0tiroj:DvKmpj3QVktj
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

njrat mpg discovery evasion persistence privilege_escalation trojan
- Njrat family
  njrat
- njRAT/Bladabindi
  Widely used RAT written in .NET.
  trojan njrat
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

njratmpgdiscoveryevasionpersistenceprivilege_escalationtrojan

behavioral2

njratmpgdiscoveryevasionpersistenceprivilege_escalationtrojan

© 2018-2026

Terms | Privacy