njrat | fb481c100a8acd081248001c1490dcbb929100cba3c8a5de5589dcfbdf911ed4 | Triage

Sharing

General

Target

Server.exe
Size

93KB
Sample

241003-jap56s1gpq
MD5

0683c7aa6477729151becf1305d3bb61
SHA1

5ce5792e3a0485b741c62b110399e2dc879b13ec
SHA256

fb481c100a8acd081248001c1490dcbb929100cba3c8a5de5589dcfbdf911ed4
SHA512

6ab18367f36e48253318bed7bafb90105d4dff24b6b0ca7e1318015b37b89d03bc07a0fb2e768fde291c2e0fd4a284dafba3fdb505752f923c11a6b49c0db231
SSDEEP

1536:kUPTr1IDavlZhbSKl9YdjEwzGi1dDYDBgS:kUPSDavlZIQmqi1dG+

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation ransomware

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

florida-institutions.gl.at.ply.gg:1213

Mutex

bede65f1f944bbd91c3a41305ecc1040

Attributes

reg_key
bede65f1f944bbd91c3a41305ecc1040
splitter
|'|'|

Targets

- Target
  
  Server.exe
- Size
  
  93KB
- MD5
  
  0683c7aa6477729151becf1305d3bb61
- SHA1
  
  5ce5792e3a0485b741c62b110399e2dc879b13ec
- SHA256
  
  fb481c100a8acd081248001c1490dcbb929100cba3c8a5de5589dcfbdf911ed4
- SHA512
  
  6ab18367f36e48253318bed7bafb90105d4dff24b6b0ca7e1318015b37b89d03bc07a0fb2e768fde291c2e0fd4a284dafba3fdb505752f923c11a6b49c0db231
- SSDEEP
  
  1536:kUPTr1IDavlZhbSKl9YdjEwzGi1dDYDBgS:kUPSDavlZIQmqi1dG+
Score

8^/10

discovery evasion persistence privilege_escalation ransomware
- Modifies Windows Firewall
  evasion
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Sets desktop wallpaper using registry
  ransomware
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defacement

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalationransomware