njrat | 2018fc40b0faeb1ddd7406ec68677a55164633ee245966a07688329459f6da7d | Triage

Sharing

General

Target

Cheat.exe
Size

65KB
Sample

240521-r8c79shf45
MD5

596bb1dd5ae0ac50a9218910d193d4cf
SHA1

377563b67e5601266d711345f78df4a7d95cad27
SHA256

2018fc40b0faeb1ddd7406ec68677a55164633ee245966a07688329459f6da7d
SHA512

b543f966b174f59384e0579935ae194bff479576007ef966c7bf1a3e3f256e9686383c21f5c239df9e28970106f7770b09fbb498400b7a26cc981a37a9555299
SSDEEP

1536:fj+u2LoN36tcQviFw1A+HIBnvbLfLteF3nLrB9z3nUaF9b6S9vM:fj+uIoN36tcQviFC9oBnnfWl9zkaF9bC

Score

10^/10

njrat njrat persistence

Malware Config

Extracted

Family

njrat

Version

Platinum

Botnet

njRat

C2

127.0.0.1:21679

Mutex

HDAudio.exe

Attributes

reg_key
HDAudio.exe
splitter
|Ghost|

Targets

- Target
  
  Cheat.exe
- Size
  
  65KB
- MD5
  
  596bb1dd5ae0ac50a9218910d193d4cf
- SHA1
  
  377563b67e5601266d711345f78df4a7d95cad27
- SHA256
  
  2018fc40b0faeb1ddd7406ec68677a55164633ee245966a07688329459f6da7d
- SHA512
  
  b543f966b174f59384e0579935ae194bff479576007ef966c7bf1a3e3f256e9686383c21f5c239df9e28970106f7770b09fbb498400b7a26cc981a37a9555299
- SSDEEP
  
  1536:fj+u2LoN36tcQviFw1A+HIBnvbLfLteF3nLrB9z3nUaF9b6S9vM:fj+uIoN36tcQviFC9oBnnfWl9zkaF9bC
Score

7^/10

persistence
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
  persistence
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Scheduled Task/Job

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1