njrat | 620a8ee5833bd9bea724d6a41d67c1d8b580e8ef3c3a86fe77adcd9a871424b2 | Triage

Sharing

General

Target

0647d85ad26dd42f69aeae272251355a.exe
Size

37KB
Sample

240906-sa1fkstanf
MD5

0647d85ad26dd42f69aeae272251355a
SHA1

c05ae179575df57a7e0e7376749056a3fad67643
SHA256

620a8ee5833bd9bea724d6a41d67c1d8b580e8ef3c3a86fe77adcd9a871424b2
SHA512

201cdc050b4c0f92c78181aa78b58ff816f344abd746c3ebd79b49518b7e15b3a6d54b34c1c495a51c0fc72f0d8f5003dfc4e576a0cef333a5bce7be410708a3
SSDEEP

384:3mOs0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM3M:NFdGdkrgYRwWS9rM+rMRa8NuiSt

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

0.tcp.eu.ngrok.io:13886

Mutex

1cfc3a4d79c70d0292d64e0bc7c3001d

Attributes

reg_key
1cfc3a4d79c70d0292d64e0bc7c3001d
splitter
|'|'|

Targets

- Target
  
  0647d85ad26dd42f69aeae272251355a.exe
- Size
  
  37KB
- MD5
  
  0647d85ad26dd42f69aeae272251355a
- SHA1
  
  c05ae179575df57a7e0e7376749056a3fad67643
- SHA256
  
  620a8ee5833bd9bea724d6a41d67c1d8b580e8ef3c3a86fe77adcd9a871424b2
- SHA512
  
  201cdc050b4c0f92c78181aa78b58ff816f344abd746c3ebd79b49518b7e15b3a6d54b34c1c495a51c0fc72f0d8f5003dfc4e576a0cef333a5bce7be410708a3
- SSDEEP
  
  384:3mOs0IiejvCVLO309QmykrtG+dA+VfwvOSiKrAF+rMRTyN/0L+EcoinblneHQM3M:NFdGdkrgYRwWS9rM+rMRa8NuiSt
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Legitimate hosting services abused for malware hosting/C2
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation