njrat | 2a103cb84af50753e1728ec5190e4b9b9c8583f602b4e9f775f0ff9ca1a9272a | Triage

Sharing

General

Target

f5d230103912e9b6015bf917e5831375.exe
Size

37KB
Sample

230318-tmx2nach42
MD5

f5d230103912e9b6015bf917e5831375
SHA1

8e50f734b5156b9a8afdcd83a4beed3442c0ae39
SHA256

2a103cb84af50753e1728ec5190e4b9b9c8583f602b4e9f775f0ff9ca1a9272a
SHA512

517beef42844fad8dfbefab0d8b1bd9f753be16ffb5eee53f4f72a4d124c22e262285b22b6ad3c0af4eb7ea54582c69c635706783b6fe68a0e89765d0f9555a8
SSDEEP

384:Q6U+yw7BeAaXaEiVbzdmB0O4yUvNixgp+Z2v/RYJ/oM6IxrAF+rMRTyN/0L+EcoQ:Jryw79POTUvNZYv64rM+rMRa8NuHvt

Score

10^/10

njrat hacked evasion

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

212.187.4.161:3232

Mutex

6bf55e0177bd5d9e7a5d6196e0752083

Attributes

reg_key
6bf55e0177bd5d9e7a5d6196e0752083
splitter
|'|'|

Targets

- Target
  
  f5d230103912e9b6015bf917e5831375.exe
- Size
  
  37KB
- MD5
  
  f5d230103912e9b6015bf917e5831375
- SHA1
  
  8e50f734b5156b9a8afdcd83a4beed3442c0ae39
- SHA256
  
  2a103cb84af50753e1728ec5190e4b9b9c8583f602b4e9f775f0ff9ca1a9272a
- SHA512
  
  517beef42844fad8dfbefab0d8b1bd9f753be16ffb5eee53f4f72a4d124c22e262285b22b6ad3c0af4eb7ea54582c69c635706783b6fe68a0e89765d0f9555a8
- SSDEEP
  
  384:Q6U+yw7BeAaXaEiVbzdmB0O4yUvNixgp+Z2v/RYJ/oM6IxrAF+rMRTyN/0L+EcoQ:Jryw79POTUvNZYv64rM+rMRa8NuHvt
Score

8^/10

evasion
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2