njrat | 1292e5a45426d40909dc8199da5fc6346a4b8a652baff6bacee9e64bb253f16c | Triage

Sharing

General

Target

c7910e75169d715e239ec9ddfc7d1508_JaffaCakes118
Size

37KB
Sample

240828-yygahavhmq
MD5

c7910e75169d715e239ec9ddfc7d1508
SHA1

9fae7eaaf264b280d8d48057d8788cbba76bc4c3
SHA256

1292e5a45426d40909dc8199da5fc6346a4b8a652baff6bacee9e64bb253f16c
SHA512

f652406d90a0fd00a58c8f7159d7a5197f86d9940b64c7bf1e02b8d1b875dc8d1b460b5f05744a6fd6235038933cb5410f7d0297766cd60ec0663a0b57b56241
SSDEEP

384:l19pkitgZf5W9cTYXyc/yK5M4azfzQnssIkSrAF+rMRTyN/0L+EcoinblneHQM32:dijjTYic/yKqcssIvrM+rMRa8NuB9t

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

zdzdzdzd.kro.kr:1

Mutex

fdb6a2048ccd0ff51cb30e142e8611b4

Attributes

reg_key
fdb6a2048ccd0ff51cb30e142e8611b4
splitter
|'|'|

Targets

- Target
  
  c7910e75169d715e239ec9ddfc7d1508_JaffaCakes118
- Size
  
  37KB
- MD5
  
  c7910e75169d715e239ec9ddfc7d1508
- SHA1
  
  9fae7eaaf264b280d8d48057d8788cbba76bc4c3
- SHA256
  
  1292e5a45426d40909dc8199da5fc6346a4b8a652baff6bacee9e64bb253f16c
- SHA512
  
  f652406d90a0fd00a58c8f7159d7a5197f86d9940b64c7bf1e02b8d1b875dc8d1b460b5f05744a6fd6235038933cb5410f7d0297766cd60ec0663a0b57b56241
- SSDEEP
  
  384:l19pkitgZf5W9cTYXyc/yK5M4azfzQnssIkSrAF+rMRTyN/0L+EcoinblneHQM32:dijjTYic/yKqcssIvrM+rMRa8NuB9t
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation