njrat | 60239c0043a1472285ba7b9975a424e9481dd1e94510952ded231294a2dd3f8f | Triage

Sharing

Copy URL Twitter E-mail

General

Target

13fbdc1f024974523245ed9bfdc3104f.exe
Size

91KB
Sample

240217-3w971scd45
MD5

13fbdc1f024974523245ed9bfdc3104f
SHA1

358c2baf3681d96f5022b25084b5eb6b726d40e7
SHA256

60239c0043a1472285ba7b9975a424e9481dd1e94510952ded231294a2dd3f8f
SHA512

b14579a5dd6079e647b576e4ea5f8e2dde21f43fea26b199c139f33dde24e70e6263761fc4216e5b406d0564caaeb3d06536fc6358cfdd8e04c2a25fbcd78e14
SSDEEP

1536:vzY+2ccZUn4D5dMqeoWuXZk5MVR1jpUv:bY+eu4D5dMqmE+MVRnU

Score

10^/10

njrat evasion

Malware Config

Extracted

Family

njrat

C2

hakim32.ddns.net:2000

Targets

- Target
  
  13fbdc1f024974523245ed9bfdc3104f.exe
- Size
  
  91KB
- MD5
  
  13fbdc1f024974523245ed9bfdc3104f
- SHA1
  
  358c2baf3681d96f5022b25084b5eb6b726d40e7
- SHA256
  
  60239c0043a1472285ba7b9975a424e9481dd1e94510952ded231294a2dd3f8f
- SHA512
  
  b14579a5dd6079e647b576e4ea5f8e2dde21f43fea26b199c139f33dde24e70e6263761fc4216e5b406d0564caaeb3d06536fc6358cfdd8e04c2a25fbcd78e14
- SSDEEP
  
  1536:vzY+2ccZUn4D5dMqeoWuXZk5MVR1jpUv:bY+eu4D5dMqmE+MVRnU
Score

8^/10

evasion
- Modifies Windows Firewall
  evasion
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2