njrat | 9b21553d8024ff5bd5a445d3c8b1bb0943566ae89754f7b2aec383b9531ddce6 | Triage

Sharing

General

Target

535644d4ec58e7f01017b11b2f446627.exe
Size

37KB
Sample

230317-ztvsrsca5y
MD5

535644d4ec58e7f01017b11b2f446627
SHA1

d47ee3cbedecc205f048c0ab58921eec35343c45
SHA256

9b21553d8024ff5bd5a445d3c8b1bb0943566ae89754f7b2aec383b9531ddce6
SHA512

265aa2d3f3cc659246a4b16737c9dd9456ffe92cfaf32f330f90963bfd2a9fd6ec90e4e60dea830e6b56851542966d9869e7a96fbdd6036d1e4b9d5b97e3b3d4
SSDEEP

384:Xpick7sgwi+tx3+j/NSyszg8QPBI3mmbNrAF+rMRTyN/0L+EcoinblneHQM3epzQ:55kQLCNhszg8QeWmZrM+rMRa8NuDOt

Score

10^/10

njrat hacked evasion persistence

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

147.50.253.218:5552

Mutex

ad4f96bb884910c0e87ac753a493adeb

Attributes

reg_key
ad4f96bb884910c0e87ac753a493adeb
splitter
|'|'|

Targets

- Target
  
  535644d4ec58e7f01017b11b2f446627.exe
- Size
  
  37KB
- MD5
  
  535644d4ec58e7f01017b11b2f446627
- SHA1
  
  d47ee3cbedecc205f048c0ab58921eec35343c45
- SHA256
  
  9b21553d8024ff5bd5a445d3c8b1bb0943566ae89754f7b2aec383b9531ddce6
- SHA512
  
  265aa2d3f3cc659246a4b16737c9dd9456ffe92cfaf32f330f90963bfd2a9fd6ec90e4e60dea830e6b56851542966d9869e7a96fbdd6036d1e4b9d5b97e3b3d4
- SSDEEP
  
  384:Xpick7sgwi+tx3+j/NSyszg8QPBI3mmbNrAF+rMRTyN/0L+EcoinblneHQM3epzQ:55kQLCNhszg8QeWmZrM+rMRa8NuDOt
Score

8^/10

evasion persistence
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence