njrat | 81a3d311446404df9a2c3c845a0bf68021c524c5bd67047e52095b864079d17f | Triage

Sharing

General

Target

Server.exe
Size

93KB
Sample

240915-wytvgsxamn
MD5

cae829650163a7e8f8f857b0ac6605ce
SHA1

2c4259e3ee77f97174c8c3fffcf07ea7c44ccff6
SHA256

81a3d311446404df9a2c3c845a0bf68021c524c5bd67047e52095b864079d17f
SHA512

ac8fcf23c5be81c5938ae2d40cabb4cad8f3b80d79f6f2ed368b3ca75ce3b30e0ac03e9a34562ddc6a6e08be569d7b5e8857cefaa8e8819577358e4f13a43226
SSDEEP

768:AY3xYnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk32sGg:5YxOx6baIa9RZj00ljEwzGi1dDSDigS

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

127.0.0.1:5552

Mutex

430b854c86e41a4fdf815c778ec40f43

Attributes

reg_key
430b854c86e41a4fdf815c778ec40f43
splitter
|'|'|

Targets

- Target
  
  Server.exe
- Size
  
  93KB
- MD5
  
  cae829650163a7e8f8f857b0ac6605ce
- SHA1
  
  2c4259e3ee77f97174c8c3fffcf07ea7c44ccff6
- SHA256
  
  81a3d311446404df9a2c3c845a0bf68021c524c5bd67047e52095b864079d17f
- SHA512
  
  ac8fcf23c5be81c5938ae2d40cabb4cad8f3b80d79f6f2ed368b3ca75ce3b30e0ac03e9a34562ddc6a6e08be569d7b5e8857cefaa8e8819577358e4f13a43226
- SSDEEP
  
  768:AY3xYnD9O/pBcxYsbae6GIXb9pDX2t98PL0OXLeuXxrjEtCdnl2pi1Rz4Rk32sGg:5YxOx6baIa9RZj00ljEwzGi1dDSDigS
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Drops autorun.inf file
  Malware can abuse Windows Autorun to spread further via attached volumes.
- Drops file in System32 directory
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Replication Through Removable Media

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation