njrat | 6c468cc738141f3da4db35af58d7021248a7b314ef4b590fbc37460309a68e40 | Triage

Sharing

General

Target

6c468cc738141f3da4db35af58d7021248a7b314ef4b590fbc37460309a68e40
Size

23KB
Sample

220201-jlh61abeb7
MD5

830266bd675abe55bc0f926015061a9a
SHA1

23f4f68c4ff55943f0d4be0c5485bec217fdf426
SHA256

6c468cc738141f3da4db35af58d7021248a7b314ef4b590fbc37460309a68e40
SHA512

4f9fcb10c44a2292926e7338b6d2223599c6cbcf35c13685eca1a4e5b4933a24b541e13e39665c94cad63d613cdcd04d9bcbb6f8509cc7791c9e6f0cf50eb1bf

Score

10^/10

njrat hacked persistence

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

0.tcp.ngrok.io:1336

Mutex

17c355154394e4dffa72121600f81011

Attributes

reg_key
17c355154394e4dffa72121600f81011
splitter
|'|'|

Targets

- Target
  
  6c468cc738141f3da4db35af58d7021248a7b314ef4b590fbc37460309a68e40
- Size
  
  23KB
- MD5
  
  830266bd675abe55bc0f926015061a9a
- SHA1
  
  23f4f68c4ff55943f0d4be0c5485bec217fdf426
- SHA256
  
  6c468cc738141f3da4db35af58d7021248a7b314ef4b590fbc37460309a68e40
- SHA512
  
  4f9fcb10c44a2292926e7338b6d2223599c6cbcf35c13685eca1a4e5b4933a24b541e13e39665c94cad63d613cdcd04d9bcbb6f8509cc7791c9e6f0cf50eb1bf
Score

8^/10

persistence
- Sets service image path in registry
  persistence
behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1