njrat | 39d1fcf8d337cd424e5d7a0628815185f72eb220f4635b14dea08e16bf5c8223 | Triage

Sharing

General

Target

dfdb8c491f30f7909d48ece8de241042_JaffaCakes118
Size

29KB
Sample

240914-kt3faawapp
MD5

dfdb8c491f30f7909d48ece8de241042
SHA1

cacf3c7c976b0655e8f5ef0306d795e329880624
SHA256

39d1fcf8d337cd424e5d7a0628815185f72eb220f4635b14dea08e16bf5c8223
SHA512

f9a1a56f2296a53d43c2bd14d3d21bb07ba31355f1ae01429c258d1ffb364f5f32c39f6769a6025b178cc07736dac3668ec0d4d7a5562fe6a98a9b99a8586e04
SSDEEP

768:EGp79Wxu0myvTPK6qrsejBKh0p29SgR6d:R79UrODKhG29j6d

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

192.168.1.10:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Targets

- Target
  
  dfdb8c491f30f7909d48ece8de241042_JaffaCakes118
- Size
  
  29KB
- MD5
  
  dfdb8c491f30f7909d48ece8de241042
- SHA1
  
  cacf3c7c976b0655e8f5ef0306d795e329880624
- SHA256
  
  39d1fcf8d337cd424e5d7a0628815185f72eb220f4635b14dea08e16bf5c8223
- SHA512
  
  f9a1a56f2296a53d43c2bd14d3d21bb07ba31355f1ae01429c258d1ffb364f5f32c39f6769a6025b178cc07736dac3668ec0d4d7a5562fe6a98a9b99a8586e04
- SSDEEP
  
  768:EGp79Wxu0myvTPK6qrsejBKh0p29SgR6d:R79UrODKhG29j6d
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation