njrat | 27ca3d69c7e562fae3c63b12811e653016cf3ce5b06b9a5885beac4f296dcb27 | Triage

Sharing

Copy URL Twitter E-mail

General

Target

Server.exe
Size

93KB
Sample

240319-ybvvdaeb51
MD5

53b43fd4a8cefb90ec44cfbc9006de4a
SHA1

59fc3c9ed58961ef846425fc1c2b0cd0bd5d83aa
SHA256

27ca3d69c7e562fae3c63b12811e653016cf3ce5b06b9a5885beac4f296dcb27
SHA512

1abbcddaf034bb6eb0e1de4871c9fdf6ce9bb86d8a5040bb83c7cb8de0aa9846cb52660c6e9406a02e1f5641bd05d923dc9366487bf786fccf775ae62e81fb50
SSDEEP

768:MY33UnD9O/pBcxYsbae6GIXb9pDX2t9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3gsGU:DUxOx6baIa9ROj00ljEwzGi1dDYDugS

Score

10^/10

njrat hacked evasion

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

grup-winy (1):9999

Mutex

fd80254f634191da7e7f820678d2a3de

Attributes

reg_key
fd80254f634191da7e7f820678d2a3de
splitter
|'|'|

Targets

- Target
  
  Server.exe
- Size
  
  93KB
- MD5
  
  53b43fd4a8cefb90ec44cfbc9006de4a
- SHA1
  
  59fc3c9ed58961ef846425fc1c2b0cd0bd5d83aa
- SHA256
  
  27ca3d69c7e562fae3c63b12811e653016cf3ce5b06b9a5885beac4f296dcb27
- SHA512
  
  1abbcddaf034bb6eb0e1de4871c9fdf6ce9bb86d8a5040bb83c7cb8de0aa9846cb52660c6e9406a02e1f5641bd05d923dc9366487bf786fccf775ae62e81fb50
- SSDEEP
  
  768:MY33UnD9O/pBcxYsbae6GIXb9pDX2t9zPL0OXLeuXxrjEtCdnl2pi1Rz4Rk3gsGU:DUxOx6baIa9ROj00ljEwzGi1dDYDugS
Score

8^/10

evasion
- Modifies Windows Firewall
  evasion
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1