njrat | 4ea43058ef91685c3dd66816e8071ee17e975ac0428beac6ceac6040b71d82d5 | Triage

Sharing

General

Target

Unconfirmed 420792.crdownload
Size

93KB
Sample

240908-n6asksxcmc
MD5

b129339df82237d6c380a217deb9560e
SHA1

493323fc6814a7ae53bb3cacacad45d03ee67533
SHA256

4ea43058ef91685c3dd66816e8071ee17e975ac0428beac6ceac6040b71d82d5
SHA512

c37a2600d3323bed642a093564de30b8bd23b725f48a969184a4bff41548939cdafbcff3f3bcd324b01e542195b6fea0953dd2bb95266e93569447a938bcb432
SSDEEP

768:PY3Xx+EX74tXUIM5YT8/GED60m9ZX7jVXXtSNOXxrjEtCdnl2pi1Rz4Rk33sGdp1:Kx+o4dT8eOvm/5tFjEwzGi1dDDDFgS

Score

10^/10

njrat zezo discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

ZeZo

C2

hakim32.ddns.net:2000

127.0.0.1:5552

Mutex

cb09cde81178b9e6da8707007a21a865

Attributes

reg_key
cb09cde81178b9e6da8707007a21a865
splitter
|'|'|

Targets

- Target
  
  Unconfirmed 420792.crdownload
- Size
  
  93KB
- MD5
  
  b129339df82237d6c380a217deb9560e
- SHA1
  
  493323fc6814a7ae53bb3cacacad45d03ee67533
- SHA256
  
  4ea43058ef91685c3dd66816e8071ee17e975ac0428beac6ceac6040b71d82d5
- SHA512
  
  c37a2600d3323bed642a093564de30b8bd23b725f48a969184a4bff41548939cdafbcff3f3bcd324b01e542195b6fea0953dd2bb95266e93569447a938bcb432
- SSDEEP
  
  768:PY3Xx+EX74tXUIM5YT8/GED60m9ZX7jVXXtSNOXxrjEtCdnl2pi1Rz4Rk33sGdp1:Kx+o4dT8eOvm/5tFjEwzGi1dDDDFgS
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Executes dropped EXE
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation