njrat | a7f0ee005b8d98bc8b67e77aa4a10baca21caf5f9deb7891bacc50f713488dd0 | Triage

Sharing

General

Target

e385a55e0f6bd4900a7f0d35507e465f_JaffaCakes118
Size

37KB
Sample

240915-2tccjawfmd
MD5

e385a55e0f6bd4900a7f0d35507e465f
SHA1

4c9e56844c0a26781e459e103c7a8c11f8d1d7ea
SHA256

a7f0ee005b8d98bc8b67e77aa4a10baca21caf5f9deb7891bacc50f713488dd0
SHA512

36eb7e80c0e46141be53a08282429653ab5e8fe949d328c21a2b85424899298db3c3af8c98aaa4425d420af4668244ce248ed40b37254ca40d0530aa94394f54
SSDEEP

384:BIeL8CT0i9NdTe/kCOyU7NuvLmDPM+CrAF+rMRTyN/0L+EcoinblneHQM3epzX9Y:BFLhT1CFU7NuKbMdrM+rMRa8NuXot

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

im523

Botnet

HacKed

C2

116.38.156.151:5050

Mutex

494ba639dc02019551401cbc1b3269b7

Attributes

reg_key
494ba639dc02019551401cbc1b3269b7
splitter
|'|'|

Targets

- Target
  
  e385a55e0f6bd4900a7f0d35507e465f_JaffaCakes118
- Size
  
  37KB
- MD5
  
  e385a55e0f6bd4900a7f0d35507e465f
- SHA1
  
  4c9e56844c0a26781e459e103c7a8c11f8d1d7ea
- SHA256
  
  a7f0ee005b8d98bc8b67e77aa4a10baca21caf5f9deb7891bacc50f713488dd0
- SHA512
  
  36eb7e80c0e46141be53a08282429653ab5e8fe949d328c21a2b85424899298db3c3af8c98aaa4425d420af4668244ce248ed40b37254ca40d0530aa94394f54
- SSDEEP
  
  384:BIeL8CT0i9NdTe/kCOyU7NuvLmDPM+CrAF+rMRTyN/0L+EcoinblneHQM3epzX9Y:BFLhT1CFU7NuKbMdrM+rMRa8NuXot
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation