njrat | 47d7951e77aaff5f193efb39d5d9111cda39bbe07ea58595d4e33ce173e7df57 | Triage

Sharing

General

Target

38a868db74f08e1fc888b6afb.exe
Size

37KB
Sample

230709-sar47sdd98
MD5

38a868db74f08e1fc888b6afb631be59
SHA1

b8007e5c2f2b1986949802b7f6cec7a9d94a63f9
SHA256

47d7951e77aaff5f193efb39d5d9111cda39bbe07ea58595d4e33ce173e7df57
SHA512

43d0ce6f87076fb038c2df401aea6391d751b6d76829fe6446633f755fe3233848e0405fc77de2d0b075d0fde0e86ed016116ba7af204b664171727793f326e7
SSDEEP

384:BmqQilQhHeTnMGiyMTFU3nuj346arAF+rMRTyN/0L+EcoinblneHQM3epzXBBNrT:kLSMGxMTFUej4xrM+rMRa8Nutjt

Score

10^/10

njrat hacked evasion

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

185.32.6.121:2000

Mutex

f0eb963c51ca1622da324360cc5c4d82

Attributes

reg_key
f0eb963c51ca1622da324360cc5c4d82
splitter
|'|'|

Targets

- Target
  
  38a868db74f08e1fc888b6afb.exe
- Size
  
  37KB
- MD5
  
  38a868db74f08e1fc888b6afb631be59
- SHA1
  
  b8007e5c2f2b1986949802b7f6cec7a9d94a63f9
- SHA256
  
  47d7951e77aaff5f193efb39d5d9111cda39bbe07ea58595d4e33ce173e7df57
- SHA512
  
  43d0ce6f87076fb038c2df401aea6391d751b6d76829fe6446633f755fe3233848e0405fc77de2d0b075d0fde0e86ed016116ba7af204b664171727793f326e7
- SSDEEP
  
  384:BmqQilQhHeTnMGiyMTFU3nuj346arAF+rMRTyN/0L+EcoinblneHQM3epzXBBNrT:kLSMGxMTFUej4xrM+rMRa8Nutjt
Score

8^/10

evasion
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2