njrat | 6c3183412fc318d586ba196d42f9399ecc84500d4624377752b4952442236093 | Triage

Sharing

General

Target

09a039699d3c2b826e5e2f8ad90f50fc.exe
Size

37KB
Sample

230324-wwfj3sge25
MD5

09a039699d3c2b826e5e2f8ad90f50fc
SHA1

158c98ba265e4829c203771eb566d607c5ab0f72
SHA256

6c3183412fc318d586ba196d42f9399ecc84500d4624377752b4952442236093
SHA512

a17c7e95fd27806da95776a81fe864e8050cbbaeb9d937ddbf2ef6dd38c88dfab5017df6706e9c1e74b51ff9ebdad22a9e78b21dcf6d8351dbba1a9c6df1d547
SSDEEP

384:/0qBkiyjnDNGRn5IyUvapIrPbh+/VsIt6xrAF+rMRTyN/0L+EcoinblneHQM3epD:M35M5jUvairANsIQxrM+rMRa8Nuu0t

Score

10^/10

njrat hacked evasion persistence

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

8.tcp.ngrok.io:10809

Mutex

477e42ad55ebd15287499bd5aac86f08

Attributes

reg_key
477e42ad55ebd15287499bd5aac86f08
splitter
|'|'|

Targets

- Target
  
  09a039699d3c2b826e5e2f8ad90f50fc.exe
- Size
  
  37KB
- MD5
  
  09a039699d3c2b826e5e2f8ad90f50fc
- SHA1
  
  158c98ba265e4829c203771eb566d607c5ab0f72
- SHA256
  
  6c3183412fc318d586ba196d42f9399ecc84500d4624377752b4952442236093
- SHA512
  
  a17c7e95fd27806da95776a81fe864e8050cbbaeb9d937ddbf2ef6dd38c88dfab5017df6706e9c1e74b51ff9ebdad22a9e78b21dcf6d8351dbba1a9c6df1d547
- SSDEEP
  
  384:/0qBkiyjnDNGRn5IyUvapIrPbh+/VsIt6xrAF+rMRTyN/0L+EcoinblneHQM3epD:M35M5jUvairANsIQxrM+rMRa8Nuu0t
Score

8^/10

evasion persistence
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Registry Run Keys / Startup Folder

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

evasionpersistence

behavioral2

evasionpersistence