njrat | 69238e764b832443cd82c2b523f23c68d1ec7fdd1cb16e968efebd12fd75debc | Triage

Sharing

General

Target

69238e764b832443cd82c2b523f23c68d1ec7fdd1cb16e968efebd12fd75debc
Size

29KB
Sample

221126-klpt8aab21
MD5

236fa756b03f2fe1e98a3ba595efed9c
SHA1

bc7ed1323a8c1b251ec379efc59bf127324a1334
SHA256

69238e764b832443cd82c2b523f23c68d1ec7fdd1cb16e968efebd12fd75debc
SHA512

4edb69785fbd73d1140a1baaef0e1892e8bb484db3fb44622d73bdf751469d6858361837ae82c258711009d058308abb1aed9f246fce1be01e526a1cc686fb44
SSDEEP

384:wXgJGJl7tj1MsagaRj5Vh+2CWmqDebD59ePbGBsbh0w4wlAokw9OhgOL1vYRGOZl:wv7nMsanBR+2cqEDveyBKh0p29SgRBr

Score

10^/10

njrat hacked evasion persistence

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

ilovetohack.ddns.net:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Targets

- Target
  
  69238e764b832443cd82c2b523f23c68d1ec7fdd1cb16e968efebd12fd75debc
- Size
  
  29KB
- MD5
  
  236fa756b03f2fe1e98a3ba595efed9c
- SHA1
  
  bc7ed1323a8c1b251ec379efc59bf127324a1334
- SHA256
  
  69238e764b832443cd82c2b523f23c68d1ec7fdd1cb16e968efebd12fd75debc
- SHA512
  
  4edb69785fbd73d1140a1baaef0e1892e8bb484db3fb44622d73bdf751469d6858361837ae82c258711009d058308abb1aed9f246fce1be01e526a1cc686fb44
- SSDEEP
  
  384:wXgJGJl7tj1MsagaRj5Vh+2CWmqDebD59ePbGBsbh0w4wlAokw9OhgOL1vYRGOZl:wv7nMsanBR+2cqEDveyBKh0p29SgRBr
Score

8^/10

evasion persistence
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence