njrat | 6722674f72bb654e619e9314a0c32936438932064ed3ff7872100a17317095ce | Triage

Sharing

General

Target

b257e67bf0f07d9da9bbeae234cc83bf.exe
Size

37KB
Sample

230318-mdncjabh73
MD5

b257e67bf0f07d9da9bbeae234cc83bf
SHA1

58ade1ccb84ff6d14d3a97f417af4ae44685ff3a
SHA256

6722674f72bb654e619e9314a0c32936438932064ed3ff7872100a17317095ce
SHA512

cfd47f7eaf262bdeb99d21ff503b962db6cb3af9ce02f3b19b8af515bda7729a4bef176b443e9b70b3cc20ac0f1240c32a435863f51e2302902bea5f8b0599ec
SSDEEP

384:FmOs0IiejvCVLO309QmykrtG+dA+VCwvOSifrAF+rMRTyN/0L+EcoinblneHQM3R:nFdGdkrgYUwWS0rM+rMRa8NuK9t

Score

10^/10

njrat hacked evasion

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

5.tcp.eu.ngrok.io:16049

Mutex

772461c24a30886a7c453c9654e24c6a

Attributes

reg_key
772461c24a30886a7c453c9654e24c6a
splitter
|'|'|

Targets

- Target
  
  b257e67bf0f07d9da9bbeae234cc83bf.exe
- Size
  
  37KB
- MD5
  
  b257e67bf0f07d9da9bbeae234cc83bf
- SHA1
  
  58ade1ccb84ff6d14d3a97f417af4ae44685ff3a
- SHA256
  
  6722674f72bb654e619e9314a0c32936438932064ed3ff7872100a17317095ce
- SHA512
  
  cfd47f7eaf262bdeb99d21ff503b962db6cb3af9ce02f3b19b8af515bda7729a4bef176b443e9b70b3cc20ac0f1240c32a435863f51e2302902bea5f8b0599ec
- SSDEEP
  
  384:FmOs0IiejvCVLO309QmykrtG+dA+VCwvOSifrAF+rMRTyN/0L+EcoinblneHQM3R:nFdGdkrgYUwWS0rM+rMRa8NuK9t
Score

8^/10

evasion
- Modifies Windows Firewall
  evasion
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

behavioral2