njrat | d4d76221e7967902519c3524609eb8c2c32dff6d626a7b520a221095a38bf476 | Triage

Sharing

General

Target

1ca1d798cf068a8ec73eb68cd8cf5d97.exe
Size

37KB
Sample

230825-ynwx7sgc3z
MD5

1ca1d798cf068a8ec73eb68cd8cf5d97
SHA1

932382d5d4b09915cfde98bd823f188cfad721a4
SHA256

d4d76221e7967902519c3524609eb8c2c32dff6d626a7b520a221095a38bf476
SHA512

98fa9020224063db62a8c099eaf1f62956c2eafc1ef57f93bc743ab2bcb74dda8e60e3f36ffa054601454fd5f9e36f9972c9834063e980dc50787c4b0f41d874
SSDEEP

384:1eSvEiTbTvpWNcZ0y8fvCv3v3cLkacparAF+rMRTyN/0L+EcoinblneHQM3epzX9:YS7TZ38fvCv3E1cQrM+rMRa8Nutjt

Score

10^/10

njrat hacked evasion

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

6.tcp.eu.ngrok.io:12360

Mutex

454fc96d4a92bc4c0b104a5e982a9b55

Attributes

reg_key
454fc96d4a92bc4c0b104a5e982a9b55
splitter
|'|'|

Targets

- Target
  
  1ca1d798cf068a8ec73eb68cd8cf5d97.exe
- Size
  
  37KB
- MD5
  
  1ca1d798cf068a8ec73eb68cd8cf5d97
- SHA1
  
  932382d5d4b09915cfde98bd823f188cfad721a4
- SHA256
  
  d4d76221e7967902519c3524609eb8c2c32dff6d626a7b520a221095a38bf476
- SHA512
  
  98fa9020224063db62a8c099eaf1f62956c2eafc1ef57f93bc743ab2bcb74dda8e60e3f36ffa054601454fd5f9e36f9972c9834063e980dc50787c4b0f41d874
- SSDEEP
  
  384:1eSvEiTbTvpWNcZ0y8fvCv3v3cLkacparAF+rMRTyN/0L+EcoinblneHQM3epzX9:YS7TZ38fvCv3E1cQrM+rMRa8Nutjt
Score

8^/10

evasion
- Modifies Windows Firewall
  evasion
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2