njrat | ebca85ea124e93d9c4f9fce64a334b3500f4037c8d8ca44769a7975f289dad24 | Triage

Sharing

General

Target

Steam-generator V1.7.bin
Size

93KB
Sample

240218-xwdk6aec27
MD5

c3a296e12add5c00df250f4ee1289ad0
SHA1

46df98413a60519d8eed3a2d0cace3ac0c95aeef
SHA256

ebca85ea124e93d9c4f9fce64a334b3500f4037c8d8ca44769a7975f289dad24
SHA512

73d8a180477fc15118fcd1f1a433bf115772c3734ce4156815f4bffad06d67ab9ad276fa76340bf26b98f54be3b705e5f62fed99af0c8d3519758fff867dc633
SSDEEP

768:lY33epD9O/pBcxYsbae6GIXb9pDX2b98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3isGB:8eLOx6baIa9RPj00ljEwzGi1dD+DlgS

Score

10^/10

njrat hacked evasion

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:1333

Mutex

c33c19c739dea795063f8124890bbf82

Attributes

reg_key
c33c19c739dea795063f8124890bbf82
splitter
|'|'|

Targets

- Target
  
  Steam-generator V1.7.bin
- Size
  
  93KB
- MD5
  
  c3a296e12add5c00df250f4ee1289ad0
- SHA1
  
  46df98413a60519d8eed3a2d0cace3ac0c95aeef
- SHA256
  
  ebca85ea124e93d9c4f9fce64a334b3500f4037c8d8ca44769a7975f289dad24
- SHA512
  
  73d8a180477fc15118fcd1f1a433bf115772c3734ce4156815f4bffad06d67ab9ad276fa76340bf26b98f54be3b705e5f62fed99af0c8d3519758fff867dc633
- SSDEEP
  
  768:lY33epD9O/pBcxYsbae6GIXb9pDX2b98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk3isGB:8eLOx6baIa9RPj00ljEwzGi1dD+DlgS
Score

8^/10

evasion
- Disables Task Manager via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- Drops startup file
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2