njrat | 0d65aac1dc725db5e6893fb97b2e2401b91ffc7fd2903e7a3c476e8701e202c5 | Triage

Sharing

General

Target

a3fe854723ec37a910eb2c9924b941ea
Size

37KB
Sample

240225-rkpldsdd98
MD5

a3fe854723ec37a910eb2c9924b941ea
SHA1

6e6120b5c83e5f997156d0a16b9fa8ffe9a983f9
SHA256

0d65aac1dc725db5e6893fb97b2e2401b91ffc7fd2903e7a3c476e8701e202c5
SHA512

d7cb20f60e73901be9d570ff7c49bf0fcc63548dfc099284432618f465a2de91f7c758262310758dff7e05b21998bf0dcff49074f252edd992a9dd4f20a538ee
SSDEEP

384:Jste5aNitbFbOn0aH2ykrkmPbZ4znCSqrAF+rMRTyN/0L+EcoinblneHQM3epzXd:2t7MNWtkrkmzuDCFrM+rMRa8Nu66t

Score

10^/10

njrat hacked evasion

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

2.tcp.ngrok.io:12980

Mutex

5560927e740a247537122b9c9336d8c8

Attributes

reg_key
5560927e740a247537122b9c9336d8c8
splitter
|'|'|

Targets

- Target
  
  a3fe854723ec37a910eb2c9924b941ea
- Size
  
  37KB
- MD5
  
  a3fe854723ec37a910eb2c9924b941ea
- SHA1
  
  6e6120b5c83e5f997156d0a16b9fa8ffe9a983f9
- SHA256
  
  0d65aac1dc725db5e6893fb97b2e2401b91ffc7fd2903e7a3c476e8701e202c5
- SHA512
  
  d7cb20f60e73901be9d570ff7c49bf0fcc63548dfc099284432618f465a2de91f7c758262310758dff7e05b21998bf0dcff49074f252edd992a9dd4f20a538ee
- SSDEEP
  
  384:Jste5aNitbFbOn0aH2ykrkmPbZ4znCSqrAF+rMRTyN/0L+EcoinblneHQM3epzXd:2t7MNWtkrkmzuDCFrM+rMRa8Nu66t
Score

8^/10

evasion
- Modifies Windows Firewall
  evasion
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2