njrat | 6ec3febd674513a33ed7c68a64fd8b02b0436a96f79b69821faad1334025937d | Triage

Sharing

General

Target

6ec3febd674513a33ed7c68a64fd8b02b0436a96f79b69821faad1334025937d.exe
Size

29KB
Sample

240927-vr4knsvekf
MD5

ca425da564d393935f4f6e65512a5c76
SHA1

dad4a18898498edf5dc784f83f18681ef16bcc89
SHA256

6ec3febd674513a33ed7c68a64fd8b02b0436a96f79b69821faad1334025937d
SHA512

29daaa562474e052cebdda46e97cf31d52db1e74cb6ba0201dd46f9d2125a4fb0a2cc02db4ed206af7a0a603a5e26b8b9dc35b265815a20fcf0896884996324b
SSDEEP

384:XFWjNl7XNRoWGVulRjr5dN2EGmqDm8Jek7GBsbh0w4wlAokw9OhgOL1vYRGOZzdO:XO7ToWGVKBV2KqrJebBKh0p29SgRf0

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

memo445.ddns.net:5552

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Targets

- Target
  
  6ec3febd674513a33ed7c68a64fd8b02b0436a96f79b69821faad1334025937d.exe
- Size
  
  29KB
- MD5
  
  ca425da564d393935f4f6e65512a5c76
- SHA1
  
  dad4a18898498edf5dc784f83f18681ef16bcc89
- SHA256
  
  6ec3febd674513a33ed7c68a64fd8b02b0436a96f79b69821faad1334025937d
- SHA512
  
  29daaa562474e052cebdda46e97cf31d52db1e74cb6ba0201dd46f9d2125a4fb0a2cc02db4ed206af7a0a603a5e26b8b9dc35b265815a20fcf0896884996324b
- SSDEEP
  
  384:XFWjNl7XNRoWGVulRjr5dN2EGmqDm8Jek7GBsbh0w4wlAokw9OhgOL1vYRGOZzdO:XO7ToWGVKBV2KqrJebBKh0p29SgRf0
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation