njrat | aaae6a35ab8defa907a7c38c3e0b2e42fe6e19b604da161593b4a3036065ff45 | Triage

Sharing

General

Target

Server.exe
Size

93KB
Sample

240522-w2n4eabh31
MD5

ebbd544c93f2757a3aa370456fc9c682
SHA1

d19633de2867a92b8bc576f58fa3f88837fbeef7
SHA256

aaae6a35ab8defa907a7c38c3e0b2e42fe6e19b604da161593b4a3036065ff45
SHA512

759bcf68c9cb7577b62383780c977de17464e6afe2f6fadd5df11bd737120ec35eeaa3fb8ae8746ac29690522bbc1e2d149c4ad4399a1256c4a8fa1460119e69
SSDEEP

1536:dg+FR8lZc+/2HxzvaDfvqjEwzGi1dDoxHgS:dg+FKc+/2Hxzir7i1dEA

Score

10^/10

njrat hacked evasion

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

5.tcp.eu.ngrok.io:15949

Mutex

44f7c969e6e46885fc38f8752cf79d6e

Attributes

reg_key
44f7c969e6e46885fc38f8752cf79d6e
splitter
|'|'|

Targets

- Target
  
  Server.exe
- Size
  
  93KB
- MD5
  
  ebbd544c93f2757a3aa370456fc9c682
- SHA1
  
  d19633de2867a92b8bc576f58fa3f88837fbeef7
- SHA256
  
  aaae6a35ab8defa907a7c38c3e0b2e42fe6e19b604da161593b4a3036065ff45
- SHA512
  
  759bcf68c9cb7577b62383780c977de17464e6afe2f6fadd5df11bd737120ec35eeaa3fb8ae8746ac29690522bbc1e2d149c4ad4399a1256c4a8fa1460119e69
- SSDEEP
  
  1536:dg+FR8lZc+/2HxzvaDfvqjEwzGi1dDoxHgS:dg+FKc+/2Hxzir7i1dEA
Score

8^/10

evasion
- Modifies Windows Firewall
  evasion
- Drops startup file
- Legitimate hosting services abused for malware hosting/C2
behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Resource Development

Reconnaissance

Tasks

static1

behavioral1