njrat | c7941f8e68c2bc7b4db43c5e32538972822c07f40a4f0004866303a9ff7098e4 | Triage

Sharing

General

Target

c7941f8e68c2bc7b4db43c5e32538972822c07f40a4f0004866303a9ff7098e4N
Size

93KB
Sample

241015-rpm85atbln
MD5

7bf3992a75bfdba7988e57aa4ff2e480
SHA1

0cfc2104383c1275abc83ec04bec0fb18a048318
SHA256

c7941f8e68c2bc7b4db43c5e32538972822c07f40a4f0004866303a9ff7098e4
SHA512

7af9081786a5132c9d5e3fefbb7c41b37a6ca0eaf2f087636cacf8527e70f09e606f6986f59d5bc7a1cc1a0c391102b275331496969f4f1331a3a5926d253a65
SSDEEP

1536:5U/r7EkrjaFIs7E5Ox8Jn8LjEwzGi1dDyDGgS:5U7jau5OKVni1d0r

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.7d

Botnet

HacKed

C2

hakim32.ddns.net:2000

region-least.gl.at.ply.gg:13623

Mutex

02281e5aca4a78b8753d24d831979224

Attributes

reg_key
02281e5aca4a78b8753d24d831979224
splitter
|'|'|

Targets

- Target
  
  c7941f8e68c2bc7b4db43c5e32538972822c07f40a4f0004866303a9ff7098e4N
- Size
  
  93KB
- MD5
  
  7bf3992a75bfdba7988e57aa4ff2e480
- SHA1
  
  0cfc2104383c1275abc83ec04bec0fb18a048318
- SHA256
  
  c7941f8e68c2bc7b4db43c5e32538972822c07f40a4f0004866303a9ff7098e4
- SHA512
  
  7af9081786a5132c9d5e3fefbb7c41b37a6ca0eaf2f087636cacf8527e70f09e606f6986f59d5bc7a1cc1a0c391102b275331496969f4f1331a3a5926d253a65
- SSDEEP
  
  1536:5U/r7EkrjaFIs7E5Ox8Jn8LjEwzGi1dDyDGgS:5U7jau5OKVni1d0r
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation