njrat | 4a7199a48c0f1084d37b2b8a8d68d9f1c29c3fd142b29ddd8e96eed0f681061e | Triage

Sharing

General

Target

4a7199a48c0f1084d37b2b8a8d68d9f1c29c3fd142b29ddd8e96eed0f681061e
Size

29KB
Sample

241021-1cntkazdlp
MD5

60dfdf92121ca4adcd41e95549665034
SHA1

c5a91a51356f9806eae6055d6507c61d74d3ec01
SHA256

4a7199a48c0f1084d37b2b8a8d68d9f1c29c3fd142b29ddd8e96eed0f681061e
SHA512

da9ca7c87f3db1b6996afcc944be1dee3f96bb22c2b72deb6d7f9dc44161e3ed7ac740f60f3d43c7094ec5a730279c7cdff4b1b2145384337c1172c5f3aa1680
SSDEEP

768:d7LeNXwlhgDZKUHZadCE8qlmeXBKh0p29SgRLK:d7Ly705KhG29jLK

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

0.6.4

Botnet

HacKed

C2

127.0.0.1:5552

Mutex

aa371e8ed3703d97ee84a5cd74e544a3

Attributes

reg_key
aa371e8ed3703d97ee84a5cd74e544a3
splitter
|'|'|

Targets

- Target
  
  4a7199a48c0f1084d37b2b8a8d68d9f1c29c3fd142b29ddd8e96eed0f681061e
- Size
  
  29KB
- MD5
  
  60dfdf92121ca4adcd41e95549665034
- SHA1
  
  c5a91a51356f9806eae6055d6507c61d74d3ec01
- SHA256
  
  4a7199a48c0f1084d37b2b8a8d68d9f1c29c3fd142b29ddd8e96eed0f681061e
- SHA512
  
  da9ca7c87f3db1b6996afcc944be1dee3f96bb22c2b72deb6d7f9dc44161e3ed7ac740f60f3d43c7094ec5a730279c7cdff4b1b2145384337c1172c5f3aa1680
- SSDEEP
  
  768:d7LeNXwlhgDZKUHZadCE8qlmeXBKh0p29SgRLK:d7Ly705KhG29jLK
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
- Drops startup file
- Adds Run key to start application
  persistence
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Boot or Logon Autostart Execution

Registry Run Keys / Startup Folder

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Modify Registry

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation

behavioral2

discoveryevasionpersistenceprivilege_escalation