njrat | 29c0f7f08d4a20f83a65b9d32a5b6c268964bc252eb10186eaf5dfe279559a24 | Triage

Sharing

General

Target

ZeusServerSide.exe
Size

37KB
Sample

240723-17b39avemh
MD5

369d5903e99751670ef0942318662c65
SHA1

2c688d2bb6b3a14358cb8977d798a7bd6efc5292
SHA256

29c0f7f08d4a20f83a65b9d32a5b6c268964bc252eb10186eaf5dfe279559a24
SHA512

b8e69d168f038be28a260f1f6dd1e0f648878e9b66a660b243d6bb1fd59e66375c110e358ed4fc5c04cf4dae7c63bb2a518e29be1fd1236e6bca1e7bd5d878d6
SSDEEP

384:kKjoUiFebK7FmpE8QyEfuifpefHCwSrAF+rMRTyN/0L+EcoinblneHQM3epzXoNK:Vt2n8LEfuiAvCzrM+rMRa8NuK0t

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

165d6ed988ac1dbec1627a1ca9899d84

Attributes

reg_key
165d6ed988ac1dbec1627a1ca9899d84
splitter
|'|'|

Targets

- Target
  
  ZeusServerSide.exe
- Size
  
  37KB
- MD5
  
  369d5903e99751670ef0942318662c65
- SHA1
  
  2c688d2bb6b3a14358cb8977d798a7bd6efc5292
- SHA256
  
  29c0f7f08d4a20f83a65b9d32a5b6c268964bc252eb10186eaf5dfe279559a24
- SHA512
  
  b8e69d168f038be28a260f1f6dd1e0f648878e9b66a660b243d6bb1fd59e66375c110e358ed4fc5c04cf4dae7c63bb2a518e29be1fd1236e6bca1e7bd5d878d6
- SSDEEP
  
  384:kKjoUiFebK7FmpE8QyEfuifpefHCwSrAF+rMRTyN/0L+EcoinblneHQM3epzXoNK:Vt2n8LEfuiAvCzrM+rMRa8NuK0t
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation