njrat | 2ad4531950ae5d29c411ca5cfa092b36eb5cfee82695a08e984b2a5379d57fec | Triage

Sharing

Copy URL Twitter E-mail

General

Target

1qwss.exe
Size

37KB
Sample

240823-wzfz1s1epn
MD5

7ba0e5137bfa7ff37035b9d64087f1d3
SHA1

301a5a8ca0507f7cbd32f67e5669dbf7862cc7a4
SHA256

2ad4531950ae5d29c411ca5cfa092b36eb5cfee82695a08e984b2a5379d57fec
SHA512

6aaf22c7c86ae93a7e73387180dbc68a5acf55c5bd1504afc41ac93e996f20c1e47370b0d16471359d429d28f0baddb02c599c31a8260ad9794d459320895be6
SSDEEP

768:LQkki91twjrlSheFCLIrM+rMRa8Nu4pt:LQkki91Ojwhe0LT+gRJNj

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

demo-device-4-mysql-instance.at.remote.it:33000

Mutex

824e0118aba537332d4fbdef02bdd499

Attributes

reg_key
824e0118aba537332d4fbdef02bdd499
splitter
|'|'|

Targets

- Target
  
  1qwss.exe
- Size
  
  37KB
- MD5
  
  7ba0e5137bfa7ff37035b9d64087f1d3
- SHA1
  
  301a5a8ca0507f7cbd32f67e5669dbf7862cc7a4
- SHA256
  
  2ad4531950ae5d29c411ca5cfa092b36eb5cfee82695a08e984b2a5379d57fec
- SHA512
  
  6aaf22c7c86ae93a7e73387180dbc68a5acf55c5bd1504afc41ac93e996f20c1e47370b0d16471359d429d28f0baddb02c599c31a8260ad9794d459320895be6
- SSDEEP
  
  768:LQkki91twjrlSheFCLIrM+rMRa8Nu4pt:LQkki91Ojwhe0LT+gRJNj
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation