njrat | 68f0022df67195e841f172e19719d42593e09aa096f37ee2b21402d9919582cd | Triage

Sharing

General

Target

0d9b4c8463b779e982e295ea8ec1b378.exe
Size

93KB
Sample

240311-njt8psah5z
MD5

0d9b4c8463b779e982e295ea8ec1b378
SHA1

b57f4a12bab535b48eefcf737a14aec30d8b70ed
SHA256

68f0022df67195e841f172e19719d42593e09aa096f37ee2b21402d9919582cd
SHA512

3ce81ff71c71f50f69dbf9fb65e4a815f4152719c1bd6e37ff8687a65eaf76e34af1478c036d7b41be5cd9ad5f05c1a1c3564f21ade167e0673b21c262e12fc0
SSDEEP

1536:6UYR8lZc+/2HK1j+1zdljEwzGi1dDLDrgS:6UYKc+/2HK1WzdSi1djk

Score

10^/10

njrat evasion

Malware Config

Extracted

Family

njrat

Version

0.7d

C2

hakim32.ddns.net:2000

0.tcp.eu.ngrok.io:19607

Mutex

933b9f5170e5a0f84efecbac99839693

Attributes

reg_key
933b9f5170e5a0f84efecbac99839693
splitter
|'|'|

Targets

- Target
  
  0d9b4c8463b779e982e295ea8ec1b378.exe
- Size
  
  93KB
- MD5
  
  0d9b4c8463b779e982e295ea8ec1b378
- SHA1
  
  b57f4a12bab535b48eefcf737a14aec30d8b70ed
- SHA256
  
  68f0022df67195e841f172e19719d42593e09aa096f37ee2b21402d9919582cd
- SHA512
  
  3ce81ff71c71f50f69dbf9fb65e4a815f4152719c1bd6e37ff8687a65eaf76e34af1478c036d7b41be5cd9ad5f05c1a1c3564f21ade167e0673b21c262e12fc0
- SSDEEP
  
  1536:6UYR8lZc+/2HK1j+1zdljEwzGi1dDLDrgS:6UYKc+/2HK1WzdSi1djk
Score

8^/10

evasion
- Modifies Windows Firewall
  evasion
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2