njrat | d0e0d585d9d3840cc31c2367e97215d025f2bb80f21e38a81294fd41277871d7 | Triage

Sharing

General

Target

c47ab566d6ea85d027927ce1090a1fc2.exe
Size

37KB
Sample

230612-dlgehsbc51
MD5

c47ab566d6ea85d027927ce1090a1fc2
SHA1

f2d76803ce7b3bcacc04465e1b81332969cc8096
SHA256

d0e0d585d9d3840cc31c2367e97215d025f2bb80f21e38a81294fd41277871d7
SHA512

bf778fcb8edd662ca85d471ca6d4b66bd0d5a6c7e333c3b3c8a06ec5689f452c2e6caa2836c5fa35cc03bc938c47455267ff87aa217534d300bf24881a724e82
SSDEEP

384:9mOq0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM3R:fLdGdkrgYRwWS9rM+rMRa8Nu6Jt

Score

10^/10

njrat hacked evasion

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

2.tcp.eu.ngrok.io:17360

Mutex

9f2e9f1c35b979a4ef12dcba15acb59d

Attributes

reg_key
9f2e9f1c35b979a4ef12dcba15acb59d
splitter
|'|'|

Targets

- Target
  
  c47ab566d6ea85d027927ce1090a1fc2.exe
- Size
  
  37KB
- MD5
  
  c47ab566d6ea85d027927ce1090a1fc2
- SHA1
  
  f2d76803ce7b3bcacc04465e1b81332969cc8096
- SHA256
  
  d0e0d585d9d3840cc31c2367e97215d025f2bb80f21e38a81294fd41277871d7
- SHA512
  
  bf778fcb8edd662ca85d471ca6d4b66bd0d5a6c7e333c3b3c8a06ec5689f452c2e6caa2836c5fa35cc03bc938c47455267ff87aa217534d300bf24881a724e82
- SSDEEP
  
  384:9mOq0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM3R:fLdGdkrgYRwWS9rM+rMRa8Nu6Jt
Score

8^/10

evasion
- Modifies Windows Firewall
  evasion
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Tasks

static1

behavioral1

behavioral2