njrat | 412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378 | Triage

Sharing

General

Target

412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
Size

93KB
Sample

240521-rhgsrsgf76
MD5

41b4d68e419abf8af4cc3006703dfb98
SHA1

18d4e9730b390eeb05b6aeba1e7fce83426c55d0
SHA256

412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378
SHA512

52f7f05999ec3f294c8631d82ab458125c74b52ac00e7c5318cf47f76e3b7a26bebd7baa327030bbd9976815c3b7f9806e35713af8f56d20d8be303e5843fd9d
SSDEEP

1536:IxwC+xhUa9urgOBPRNvM4jEwzGi1dDOD+gS:IxmUa9urgObdGi1dIj

Score

10^/10

njrat hacked evasion

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

0.tcp.eu.ngrok.io:14740

Mutex

dc435c01296ef18222dfec8794454255

Attributes

reg_key
dc435c01296ef18222dfec8794454255
splitter
|'|'|

Targets

- Target
  
  412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378.exe
- Size
  
  93KB
- MD5
  
  41b4d68e419abf8af4cc3006703dfb98
- SHA1
  
  18d4e9730b390eeb05b6aeba1e7fce83426c55d0
- SHA256
  
  412e7797503d5fa081fc2df80b5097c3ba3536f6716b34d1a61e2abde66cf378
- SHA512
  
  52f7f05999ec3f294c8631d82ab458125c74b52ac00e7c5318cf47f76e3b7a26bebd7baa327030bbd9976815c3b7f9806e35713af8f56d20d8be303e5843fd9d
- SSDEEP
  
  1536:IxwC+xhUa9urgOBPRNvM4jEwzGi1dDOD+gS:IxmUa9urgObdGi1dIj
Score

8^/10

evasion
- Disables Task Manager via registry modification
  evasion
- Modifies Windows Firewall
  evasion
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2