njrat | bc228f9d761133c53a25e3a7fbd7a599a6e028b5e59730bd33c3c0bbdc367d96 | Triage

Sharing

General

Target

Server.exe
Size

40KB
Sample

241027-xq39maymbx
MD5

d68c05c79e88c0778ccbd2dd61d8e51e
SHA1

ab6161248a94b0bca947a252a2a9da0c4a2e18d4
SHA256

bc228f9d761133c53a25e3a7fbd7a599a6e028b5e59730bd33c3c0bbdc367d96
SHA512

6447a9504828e4a196e984dafc8c364d261022146875f252c91b387fcc0c968050f253c57f586e36439940c47ea0e18fd10ad6f9a7964b40cd41acd94b541ceb
SSDEEP

768:SRriitlfEX65LCWQI4iAOuQdOsVhyV6QM3DI:SRriitlg1I4NOuchyET

Score

10^/10

njrat hacked discovery evasion persistence privilege_escalation

Malware Config

Extracted

Family

njrat

Version

1.9

Botnet

HacKed

Mutex

Microsoft.Exe

Attributes

reg_key
Microsoft.Exe

Targets

- Target
  
  Server.exe
- Size
  
  40KB
- MD5
  
  d68c05c79e88c0778ccbd2dd61d8e51e
- SHA1
  
  ab6161248a94b0bca947a252a2a9da0c4a2e18d4
- SHA256
  
  bc228f9d761133c53a25e3a7fbd7a599a6e028b5e59730bd33c3c0bbdc367d96
- SHA512
  
  6447a9504828e4a196e984dafc8c364d261022146875f252c91b387fcc0c968050f253c57f586e36439940c47ea0e18fd10ad6f9a7964b40cd41acd94b541ceb
- SSDEEP
  
  768:SRriitlfEX65LCWQI4iAOuQdOsVhyV6QM3DI:SRriitlg1I4NOuchyET
Score

8^/10

discovery evasion persistence privilege_escalation
- Modifies Windows Firewall
  evasion
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Privilege Escalation

Create or Modify System Process

Windows Service

Event Triggered Execution

Netsh Helper DLL

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

discoveryevasionpersistenceprivilege_escalation