njrat | 1ab5a32c95f4645f124b455ccbd65a46e56897a9f0f62e3edd8a8c3ea06189ab | Triage

Sharing

General

Target

1ab5a32c95f4645f124b455ccbd65a46e56897a9f0f62e3edd8a8c3ea06189ab.exe
Size

29KB
Sample

240928-l97wdasflb
MD5

ac93ce6935848930ac86704f468157ab
SHA1

7c34db340470b0452aaa6c9b50cda9f6947fc375
SHA256

1ab5a32c95f4645f124b455ccbd65a46e56897a9f0f62e3edd8a8c3ea06189ab
SHA512

8229aca448803069dd076325a3eebeda4cd579f06376aa6f50d51af7f3ccbbfddbb40df6318f92a199b9f76f562f9905fcfe8b0e997beacd27cce1773d7beb87
SSDEEP

384:T4SWjNl7XNRoWGVulRVJ5zaImGmqDcI6ewdGBsbh0w4wlAokw9OhgOL1vYRGOZzp:TK7ToWGVKhcI4qN6exBKh0p29SgR6u

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

192.168.1.2:1177

Mutex

5cd8f17f4086744065eb0992a09e05a2

Attributes

reg_key
5cd8f17f4086744065eb0992a09e05a2
splitter
|'|'|

Targets

- Target
  
  1ab5a32c95f4645f124b455ccbd65a46e56897a9f0f62e3edd8a8c3ea06189ab.exe
- Size
  
  29KB
- MD5
  
  ac93ce6935848930ac86704f468157ab
- SHA1
  
  7c34db340470b0452aaa6c9b50cda9f6947fc375
- SHA256
  
  1ab5a32c95f4645f124b455ccbd65a46e56897a9f0f62e3edd8a8c3ea06189ab
- SHA512
  
  8229aca448803069dd076325a3eebeda4cd579f06376aa6f50d51af7f3ccbbfddbb40df6318f92a199b9f76f562f9905fcfe8b0e997beacd27cce1773d7beb87
- SSDEEP
  
  384:T4SWjNl7XNRoWGVulRVJ5zaImGmqDcI6ewdGBsbh0w4wlAokw9OhgOL1vYRGOZzp:TK7ToWGVKhcI4qN6exBKh0p29SgR6u
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation