njrat | 8a429aab8c6fb77e858386f53694c6239f7088ed58ac73c25bb2969cbf87cb3a | Triage

Sharing

General

Target

0x000900000001414e66dat.dat
Size

93KB
Sample

230704-yxpv9age26
MD5

57b8df6044bbfa7706f1b900216d1da0
SHA1

a21f6e715a41e61820ebb3e428242f848e0cd4c9
SHA256

8a429aab8c6fb77e858386f53694c6239f7088ed58ac73c25bb2969cbf87cb3a
SHA512

a4670d23fe66c7ce53ccc79342b9927e7f08e62401d105116517d7e75741eae852eec1d4b4c11ea8a1e5213ed6ddc2dd74e0fe8ac45ece46f5e12bac8f6e5ee0
SSDEEP

1536:oqHFQWqkqqoLc2mUiIjEwzGi1dDjDbgS:oqHmkqqoA2zi5i1djU

Score

10^/10

njrat hacker evasion

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HACKER

C2

hakim32.ddns.net:2000

numbers-characterization.at.ply.gg:45038

Mutex

ba79c07aec28b61ac839eeb4fafa3141

Attributes

reg_key
ba79c07aec28b61ac839eeb4fafa3141
splitter
|'|'|

Targets

- Target
  
  0x000900000001414e66dat.dat
- Size
  
  93KB
- MD5
  
  57b8df6044bbfa7706f1b900216d1da0
- SHA1
  
  a21f6e715a41e61820ebb3e428242f848e0cd4c9
- SHA256
  
  8a429aab8c6fb77e858386f53694c6239f7088ed58ac73c25bb2969cbf87cb3a
- SHA512
  
  a4670d23fe66c7ce53ccc79342b9927e7f08e62401d105116517d7e75741eae852eec1d4b4c11ea8a1e5213ed6ddc2dd74e0fe8ac45ece46f5e12bac8f6e5ee0
- SSDEEP
  
  1536:oqHFQWqkqqoLc2mUiIjEwzGi1dDjDbgS:oqHmkqqoA2zi5i1djU
Score

8^/10

evasion
- Modifies Windows Firewall
  evasion
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks

static1

behavioral1

behavioral2