Overview

overview

10

Static

static

10

501cd09125...e0.exe

windows7-x64

10

501cd09125...e0.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    501cd09125b0d60c8612ee07d41aa6e0.exe
  • Size 134KB
  • Sample240820-pff3ca1djc
  • SHA256 0ff34979bd780fdaabef5d9f97d20499ef8c60aaf7e82200c822894d8ecd8cb5
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
njratsazandiscoveryevasionpersistencetrojan

Malware Config

Extracted

Family

  • njrat

Version

  • <- NjRAT 0.7d Horror Edition ->

Botnet

  • Sazan

C2

  • 84.32.231.176:1610

Mutex

  • 5f1f65bec0cfed61b046be01c3f0b40e

Attributes
  • reg_key

    5f1f65bec0cfed61b046be01c3f0b40e

  • splitter

    Y262SUCZ4UJJ

Targets

    • Target
      501cd09125b0d60c8612ee07d41aa6e0.exe
    • Size 134KB
    • SHA256 0ff34979bd780fdaabef5d9f97d20499ef8c60aaf7e82200c822894d8ecd8cb5
    • MD5 SHA1 SHA512 SSDEEP
    Score
    10/10
    njratsazandiscoveryevasionpersistencetrojan
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Hide Artifacts

1
T1564

Hidden Files and Directories

1
T1564.001

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

3
T1112

Credential Access

Discovery

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks