njRAT

Malware & Tools · njRAT

· MalwareS0385 · Zararlı Yazılım

Type

malware

Techniques

Used By

8 groups

Platforms

Windows

Description

njRAT is a remote access tool (RAT) that was first observed in 2012. It has been used by threat actors in the Middle East.(Citation: Fidelis njRAT June 2013)

Tactic Coverage

discovery (8)command and control (5)collection (4)stealth (4)execution (3)lateral movement (2)credential access (2)defense impairment (2)persistence (2)exfiltration (1)initial access (1)privilege escalation (1)

Used By (8 groups)

G0099APT-C-36Blind Eagle, TAG-144 G0096APT41Wicked Panda, Brass Typhoon G0143Aquatic Panda G0078Gorgon Group G0043Group5 G0140LazyScripter G1018TA2541

Techniques (31)

T1005Data from Local System

collection

T1010Application Window Discovery

discovery

T1012Query Registry

discovery

T1018Remote System Discovery

discovery

T1021.001Remote Desktop Protocol

lateral movement

T1027.004Compile After Delivery

stealth

T1027.013Encrypted/Encoded File

References

https://attack.mitre.org/software/S0385 https://web.archive.org/web/20200302085808/https://www.fireeye.com/blog/threat-research/2013/08/njw0rm-brother-from-the-same-mother.html https://www.threatminer.org/_reports/2013/fta-1009---njrat-uncovered-1.pdf https://blog.trendmicro.com/trendlabs-security-intelligence/autoit-compiled-worm-affecting-removable-media-delivers-fileless-version-of-bladabindi-njrat-backdoor/

COPPER FIELDSTONE, APT36

T1033System Owner/User Discovery

discovery

T1041Exfiltration Over C2 Channel

exfiltration

T1056.001Keylogging

collectioncredential access

T1057Process Discovery

discovery

T1059.001PowerShell

execution

T1059.003Windows Command Shell

execution

T1070.004File Deletion

stealth

T1070.009Clear Persistence

stealth

T1071.001Web Protocols

command and control

T1082System Information Discovery

discovery

T1083File and Directory Discovery

discovery

T1091Replication Through Removable Media

lateral movementinitial access

T1105Ingress Tool Transfer

command and control

T1106Native API

execution

T1112Modify Registry

defense impairmentpersistence

T1113Screen Capture

collection

T1120Peripheral Device Discovery

discovery

T1125Video Capture

collection

T1132.001Standard Encoding

command and control

T1547.001Registry Run Keys / Startup Folder

persistenceprivilege escalation

T1555.003Credentials from Web Browsers

credential access

T1568.001Fast Flux DNS

command and control

T1571Non-Standard Port

command and control

T1686.003Windows Host Firewall

defense impairment